26:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/23qlsjvno4-wq.js","/_next/static/chunks/11pkz44bx8x1b.js","/_next/static/chunks/04k_7k5p4krw4.js"],"ReportDetailWrapper"] 55:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 25:T58a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Application.Generic — Falcon Sandbox Report — Score 100/100 — Sample a511be5164dc…","description":"Malicious verdict for sandbox report 69815cfe79aa…. Malware family: Application.Generic. Threat score 100/100. 4 malicious and 17 suspicious behavioral indicators across 188 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9/69815cfe79aaebf2bf0d7bb4","keywords":["Malicious","Application.Generic","sandbox report","malware analysis","MITRE ATT\u0026CK","a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9"],"about":{"@type":"SoftwareApplication","name":"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin","applicationCategory":"PE32 executable for MS Windows 4.00 (GUI), Intel i386, Nullsoft Installer self-extracting archive, 5 sections","identifier":"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Application.Generic","sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":4,"suspicious":17,"totalSignatures":188},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4i7ugAAAAAAAAePjwAAB/j4i7qqAAAAAAAH+PgHAHh/j7uqqIAAAAAAB4+PCHB3h/iLqoiAAAAAAAf4+AeHeHh/i6iI7gAAAAAHj48Id4eHhwCo7u4AAAAAB/j4B4d4eHAADu6IAAAAAAePjwh3iI7gAAeHhwAAAAAH+PgHh47orgB4eHgAAAAAB///CHfuiu6/94eHAAAAAAf//weHeK7uv494cAAAAAAH//8IeHru67j494CIiIAAB///CIiH7ru4j48AAAiHAAf//wiIgHe7uIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH8AAAAAAAD4cAAAAAd3dwB/AAAAAAAA+HAAAAAAf//wfwAADwDwAPhwAAAAAAd3dw8AAA8A8AD4cAAAAAAAAAB/AAAP//8A+HAAAAAAAAAAfwAAD///APhwAAAAAAAAAH8A//8AAAD4cAAAAAAAAAB/AA/wAAAA+HAAAAAAAAAAfwAAAAAAAPhwAAAAAAAAAH8AAAAAAAD4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4i7ugAAAAAAAAePjwAAB/j4i7qqAAAAAAAH+PgHAHh/j7uqqIAAAAAAB4+PCHB3h/iLqoiAAAAAAAf4+AeHeHh/i6iI7gAAAAAHj48Id4eHhwCo7u4AAAAAB/j4B4d4eHAADu6IAAAAAAePjwh3iI7gAAeHhwAAAAAH+PgHh47orgB4eHgAAAAAB///CHfuiu6/94eHAAAAAAf//weHeK7uv494cAAAAAAH//8IeHru67j494CIiIAAB///CIiH7ru4j48AAAiHAAf//wiIgHe7uIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH8AAAAAAAD4cAAAAAd3dwB/AAAAAAAA+HAAAAAAf//wfwAADwDwAPhwAAAAAAd3dw8AAA8A8AD4cAAAAAAAAAB/AAAP//8A+HAAAAAAAAAAfwAAD///APhwAAAAAAAAAH8A//8AAAD4cAAAAAAAAAB/AA/wAAAA+HAAAAAAAAAAfwAAAAAAAPhwAAAAAAAAAH8AAAAAAAD4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==29:T644,Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp, 00000000-00004800.00000000.241889.72B0E000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp, 00000000-00004800.00000000.241889.72B0E000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp")2a:T4d6,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp, 00000000-00004800.00000000.241889.72B0E000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp, 00000000-00004800.00000000.241889.72B0E000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004800.00000000.241889.00A74000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004800.00000000.241889.72B0E000.00000002.mdmp")2b:T893,"BluetoothService.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "BluetoothService.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "BluetoothService.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP") "BluetoothService.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "BluetoothService.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "BluetoothService.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "BluetoothService.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610") "BluetoothService.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "BluetoothService.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "BluetoothService.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER") "BluetoothService.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER") "BluetoothService.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE") "BluetoothService.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "BluetoothService.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\WOW6432NODE") "BluetoothService.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SECURITY") "BluetoothService.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SECURITY") "BluetoothService.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\HVSI") "BluetoothService.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP")2c:T7ae," Microsoft Corporation","version_info":[{"id":"FileVersion","value":"23.0.8.132"},{"id":"ProductVersion","value":"23.0.8.132"},{"id":"CompanyName","value":"Bitdefender"},{"id":"FileDescription","value":"Bitdefender Submission Wizard"},{"id":"InternalName","value":"BDSubWiz"},{"id":"LegalCopyright","value":"1997-2018 Bitdefender"},{"id":"OriginalFilename","value":"BDSubWiz.exe"},{"id":"ProductName","value":"Bitdefender ConnectAgent"},{"id":"Translation","value":"0x0409 0x04b0"}],"file_sections":[{"name":".text","entropy":6.4921644757505135,"virtual_address":"0x1000","virtual_size":"0x929ea","raw_size":"0x92a00","md5":"e2176dfc5e1ce5fa150aa487495fe9a2"},{"name":".rdata","entropy":4.922169026647947,"virtual_address":"0x94000","virtual_size":"0x23b26","raw_size":"0x23c00","md5":"c55c169bc46f3a49322db04e4f54a407"},{"name":".data","entropy":4.7996393404579285,"virtual_address":"0xb8000","virtual_size":"0x50d8","raw_size":"0x3a00","md5":"352f23343fdcdf2fa3a692ecc1173506"},{"name":".rsrc","entropy":5.286214716985174,"virtual_address":"0xbe000","virtual_size":"0x1f544","raw_size":"0x1f600","md5":"9232d2e77d07bd3a2ae3e14bbfaa7780"},{"name":".reloc","entropy":6.588415729144966,"virtual_address":"0xde000","virtual_size":"0x7100","raw_size":"0x7200","md5":"1a95d08833bd13fd088a662c5536d710"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["AdjustTokenPrivileges","LookupPrivilegeValueW","OpenProcessToken","RegCloseKey","RegOpenKeyExW","RegQueryValueExW"]},{"module":"CRYPT32.dll","functions":["CryptUnprotectData"]},{"module":"KERNEL32.dll","functions":["ChangeTimerQueueTimer","CloseHandle","CompareStringW","CopyFileW","CreateEventW","CreateFileW","CreateThread","CreateTimerQueue","CreateTimerQueueTimer","DecodePointer","DeleteCriticalSection","DeleteFileW","DeleteTimerQueueTimer","DuplicateHandle","EncodePointer","EnterCriticalSection","EnumSystemLocalesW","ExitProcess","FindClose","FindFirstFileExW","FindFirstFileW","FindNextFileW","FindResourceExW","FindResourceW","FlushFileBuffers","FormatMessageW","FreeEnvironmentStringsW","FreeLibrary","FreeLibraryAndExitThread","GetACP","GetCommandLineA","GetCommandLineW","GetConsoleCP","GetConsoleMode","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThread","GetCurrentThreadId","GetDateFormatW","GetEnvironmentStringsW","GetFileAttributesW","GetFileType","GetLastError","GetLocaleInfoW","GetLogicalProcessorInformation","GetModuleFileNameW","GetModuleHandleA","GetModuleHandleExW","GetModuleHandleW","GetNumaHighestNodeNumber","GetOEMCP","GetProcAddress","GetProcessAffinityMask","GetProcessHeap","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemTimeAsFileTime","GetThreadPriority","GetThreadTimes","GetTickCount","GetTimeFormatW","GetTimeZoneInformation","GetUserDefaultLCID","GetVersionExW","GlobalAlloc","GlobalLock","GlobalUnlock","HeapAlloc","HeapDestroy","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSection","InitializeCriticalSectionAndSpinCount","InitializeCriticalSectionEx","InitializeSListHead","InterlockedFlushSList","InterlockedPopEntrySList","InterlockedPushEntrySList","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","IsValidLocale","LCMapStringW","LeaveCriticalSection","LoadLibraryExW","LoadLibraryW","LoadResource","LocalAlloc","LocalFree","LockResource","lstrcpynW","MoveFileExW","MultiByteToWideChar","OutputDebugStringW","QueryDepthSList","QueryPerformanceCounter","QueueUserWorkItem","RaiseException","ReadConsoleW","ReadFile","RegisterWaitForSingleObject","ReleaseSemaphore","ResetEvent","RtlUnwind","SetEndOfFile","SetEnvironmentVariableA","SetEvent","SetFilePointerEx","SetLastError","SetStdHandle","SetThreadAffinityMask","SetThreadPriority","SetUnhandledExceptionFilter","SignalObjectAndWait","SizeofResource","Sleep","SwitchToThread","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","TryEnterCriticalSection","UnhandledExceptionFilter","UnregisterWait","UnregisterWaitEx","VirtualAlloc","VirtualFree","VirtualProtect","WaitForSingleObjectEx","WideCharToMultiByte","WriteConsoleW","WriteFile"]},{"module":"ole32.dll","functions":["CoCreateGuid","OleInitialize","OleUninitialize"]},{"module":"SHELL32.dll","functions":["CommandLineToArgvW","ShellExecuteExW","ShellExecuteW"]},{"module":"SHLWAPI.dll","functions":["AssocQueryStringW","PathAppendW","PathCombineW","PathFileExistsW","PathIsRelativeW","PathRemoveFileSpecW","PathStripPathW","SHGetValueW"]},{"module":"USER32.dll","functions":["AllowSetForegroundWindow","BringWindowToTop","CloseClipboard","CopyRect","CreateDialogIndirectParamW","DefDlgProcW","DestroyIcon","DestroyWindow","DispatchMessageW","EmptyClipboard","EnableWindow","ExitWindowsEx","GetActiveWindow","GetAncestor","GetClientRect","GetCursorPos","GetDesktopWindow","GetForegroundWindow","GetMessageW","GetMonitorInfoW","GetPropW","GetWindowLongW","GetWindowRect","IsDialogMessageW","IsWindow","KillTimer","LoadStringW","MonitorFromPoint","MonitorFromRect","MoveWindow","OffsetRect","OpenClipboard","PostMessageW","RegisterClassExW","RegisterWindowMessageW","SendMessageW","SetActiveWindow","SetClipboardData","SetParent","SetTimer","SetWindowLongW","SetWindowPos","SetWindowTextW","ShowScrollBar","ShowWindow","SystemParametersInfoW","TranslateMessage","wsprintfW"]},{"module":"VERSION.dll","functions":["GetFileVersionInfoSizeW","GetFileVersionInfoW","VerQueryValueW"]},{"module":"WINMM.dll","functions":["timeGetTime"]}],"file_exports":[]}}],"file_metadata":{"file_compositions":[],"imported_objects":[],"file_analysis":[],"total_file_compositions_imports":null},"processes":[{"uid":"00000000-00006976","parentuid":null,"name":"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin.exe","normalized_path":"C:\\a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin.exe","command_line":null,"sha256":"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9","av_label":"Application.Generic","av_matched":6,"av_total":26,"pid":"6976","icon":"$27","process_flags":[{"name":"Multiscan Match","data":"6/26"}]},{"uid":"00000000-00004800","parentuid":"00000000-00006976","name":"BluetoothService.exe","normalized_path":"%APPDATA%\\Bluetooth\\BluetoothService.exe","command_line":null,"sha256":"2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924","av_label":null,"av_matched":null,"av_total":null,"pid":"4800","icon":null,"process_flags":[]},{"uid":"00000000-00002564","parentuid":null,"name":"BluetoothService.exe","normalized_path":"%APPDATA%\\Bluetooth\\BluetoothService.exe","command_line":"-i","sha256":"2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924","av_label":null,"av_matched":null,"av_total":null,"pid":"2564","icon":"$28","process_flags":[]},{"uid":"00000000-00005624","parentuid":"00000000-00002564","name":"BluetoothService.exe","normalized_path":"%APPDATA%\\Bluetooth\\BluetoothService.exe","command_line":"-k","sha256":"2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924","av_label":null,"av_matched":null,"av_total":null,"pid":"5624","icon":null,"process_flags":[]}],"mitre_attcks":[{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":1,"malicious_identifiers":["Calls an API typically used to execute an application"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":13,"informative_identifiers":["Contains ability to execute an application (API string)","Contains ability to create a new process (API string)","Contains ability to create/open files (API string)","Contains ability to execute Windows APIs","Contains ability to retrieve the fully qualified path of module (API string)","Contains ability to retrieve/modify process thread (API string)","Contains ability to retrieve address of exported function from a DLL (API string)","Calls an API typically used to create a process","Calls an API typically used to retrieve function addresses","Input file contains API references not part of its Import Address Table (IAT)","Contains ability to load modules (API string)","Contains ability to set/get the last-error code for a calling thread (API string)","Contains ability to find and load resources of specific modules (API string)"],"parent":null},{"tactic":"Execution","technique":"Windows Command Shell","attck_id":"T1059.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to retrieve command line parameters of the running process","Contains ability to retrieve the command-line string for the current process (API string)"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Service Execution","attck_id":"T1569.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Opened the service control manager"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"System Services","attck_id":"T1569","attck_id_wiki":"https://attack.mitre.org/techniques/T1569"}},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/techniques/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to execute a WMI query"],"parent":null},{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Loads modules at runtime","Calls an API typically used to load libraries","Loads the RPC (Remote Procedure Call) module DLL"],"parent":null},{"tactic":"Persistence","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Able to delete registry key/value (API string)","Contains ability to modify registry key/value (API string)","Able to create/load registry keys (API string)","Writes registry keys"],"parent":null},{"tactic":"Persistence","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":1,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to access device drivers","Contains ability to create a service (API string)","Creates or modifies windows services"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Persistence","technique":"DLL","attck_id":"T1574.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Potential hijacking of DLL execution flow detected","Possible DLL sideloading"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to impersonate access tokens (API string)"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":1,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to access device drivers","Contains ability to create a service (API string)","Creates or modifies windows services"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify access token privileges (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":2,"malicious_identifiers":["Writes data to a remote process","Creates a process in suspended mode (likely for process injection)"],"suspicious_identifiers_count":1,"suspicious_identifiers":["Spawned processes are likely due to an injection"],"informative_identifiers_count":1,"informative_identifiers":["Able to inject code into another process (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"DLL","attck_id":"T1574.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Potential hijacking of DLL execution flow detected","Possible DLL sideloading"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attck_id":"T1055.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts remote code execution into another process memory space"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attck_id":"T1068","attck_id_wiki":"https://attack.mitre.org/techniques/T1068","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Opens the Kernel Security Device Driver (KsecDD) of Windows"],"parent":null},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attck_id":"T1055.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Able to delete registry key/value (API string)","Contains ability to modify registry key/value (API string)","Able to create/load registry keys (API string)","Writes registry keys"],"parent":null},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to impersonate access tokens (API string)"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attck_id":"T1222","attck_id_wiki":"https://attack.mitre.org/techniques/T1222","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify file attributes (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Queries kernel debugger information"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to check debugger is running (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Dropped file has high entropy (likely encrypted/compressed content)"],"informative_identifiers_count":5,"informative_identifiers":["Contains CRYPTO related strings","Sample file has high entropy (likely encrypted/compressed content)","Loads the Bcrypt module DLL","Matched Compiler/Packer signature (DIE)","Shows ability to obfuscate file or information"],"parent":null},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to identify virtual environment using user register activity","Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify access token privileges (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to method used by Windows shell items (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to pass information to a window procedure (API string)","Contains ability to show a graphical window (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1070.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Marks file for deletion","Opens file with deletion access rights"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to delete files/directories (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":2,"malicious_identifiers":["Writes data to a remote process","Creates a process in suspended mode (likely for process injection)"],"suspicious_identifiers_count":1,"suspicious_identifiers":["Spawned processes are likely due to an injection"],"informative_identifiers_count":1,"informative_identifiers":["Able to inject code into another process (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attck_id":"T1140","attck_id_wiki":"https://attack.mitre.org/techniques/T1140","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform decryption (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Observed a high volume of repeated registry API calls (API Hammering)"],"parent":null},{"tactic":"Defense Evasion","technique":"Timestomp","attck_id":"T1070.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve file time (API string)","Contains ability to set file time (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attck_id":"T1006","attck_id_wiki":"https://attack.mitre.org/techniques/T1006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to read volume data via DOS device path"],"parent":null},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attck_id":"T1027.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["XOR operations in executable file detected"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Drops files inside appdata directory"],"parent":null},{"tactic":"Defense Evasion","technique":"DLL","attck_id":"T1574.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Potential hijacking of DLL execution flow detected","Possible DLL sideloading"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attck_id":"T1027.013","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/013","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Drops file with high entropy, indicating encryption/obfuscation"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Portable Executable Injection","attck_id":"T1055.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts remote code execution into another process memory space"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attck_id":"T1480","attck_id_wiki":"https://attack.mitre.org/techniques/T1480","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Creates mutants","Shows ability to use execution guardrails"],"parent":null},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Asynchronous Procedure Call","attck_id":"T1055.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attck_id":"T1539","attck_id_wiki":"https://attack.mitre.org/techniques/T1539","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Able to retrieve browser cookies using SQL","Attempts to obtain browser cookies (file access)"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Credential Access","technique":"OS Credential Dumping","attck_id":"T1003","attck_id_wiki":"https://attack.mitre.org/techniques/T1003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"],"parent":null},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attck_id":"T1558","attck_id_wiki":"https://attack.mitre.org/techniques/T1558","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to access credential file using Kerberos"],"parent":null},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains string like password/secret"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/techniques/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to retrieve open application windows (API string)","Contains ability to find open windows (API string)","Calls an API possibly used to retrieve a handle to the foreground window"],"parent":null},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Reads configuration files (.ini files)"],"informative_identifiers_count":12,"informative_identifiers":["Contains ability to read files (API string)","Contains ability to retrieve file and directory information (API string)","Contains ability to retrieve path in which Windows is installed (API string)","Contains ability to enumerate files on disk (API string)","Able to rename or move file/directory (API string)","Contains ability to verify if file exist on disk (API string)","Touches files","Tries to access non-existent files (non-executable)","Tries to access non-existent files (executable)","Reads files","References Windows file paths for DLLs (possible dropped files)","Touches files in the Windows directory"],"parent":null},{"tactic":"Discovery","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Queries kernel debugger information"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to check debugger is running (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":15,"informative_identifiers":["Contains ability to retrieve the OS information (API string)","Contains ability to retrieve the specified system metric or system configuration setting (API string)","Able to retrieve information about the current system (API string)","Contains ability to retrieve windows environment variables","Able to discover operating system information (API string)","Calls an API typically used to get system version information","References to WMI query strings used for information discovery","Reads the active computer name","Contains ability to read software policies","Attempts to call APIs to gather system and hardware detail","Calls an API typically used to retrieve computer name","Contains ability to retrieve a module handle (API string)","Able to query volume/memory size (API string)","Calls an API typically used to get product type","Reads information about supported languages"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":4,"suspicious_identifiers":["Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","Checks warning level of secure to non-secure traffic redirection"],"informative_identifiers_count":6,"informative_identifiers":["Contains registry location strings","Found registry key string for installed applications","Found registry location strings in memory","Opens registry keys","Able to query registry keys (API string)","Queries registry keys"],"parent":null},{"tactic":"Discovery","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to identify virtual environment using user register activity","Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to query system locale information (API string)"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":8,"informative_identifiers":["Contains ability to retrieve/open a process (API string)","Queries process information","Contains ability to enumerate process and/or its information (API string)","Calls an API typically used for taking snapshot of the specified processes","Queries basic information of the specified process","Spawns new processes","Process launched with changed environment","Spawns new processes that are not known child processes"],"parent":null},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to retrieve system language (API string)","Reads the windows installation language"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Requested access to a system service"],"informative_identifiers_count":2,"informative_identifiers":["Able to enumerate service (API string)","Queries services related registry keys"],"parent":null},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/techniques/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to retrieve machine timezone (API string)","Contains ability to retrieve machine time (API string)","Able to retrieve date formats supported by the local system (API string)"],"parent":null},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Observed a high volume of repeated registry API calls (API Hammering)"],"parent":null},{"tactic":"Discovery","technique":"System Owner/User Discovery","attck_id":"T1033","attck_id_wiki":"https://attack.mitre.org/techniques/T1033","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Calls an API typically used to retrieve user name","Contains ability to retrieve usernames and/or user information (API string)"],"parent":null},{"tactic":"Discovery","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"Software Discovery","attck_id":"T1518","attck_id_wiki":"https://attack.mitre.org/techniques/T1518","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Reads the registry for installed applications"],"parent":null},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attck_id":"T1570","attck_id_wiki":"https://attack.mitre.org/techniques/T1570","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to move file or directory (API string)"],"parent":null},{"tactic":"Collection","technique":"Screen Capture","attck_id":"T1113","attck_id_wiki":"https://attack.mitre.org/techniques/T1113","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API possibly used to take screenshots"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to capture screen (API string)"],"parent":null},{"tactic":"Collection","technique":"Local Data Staging","attck_id":"T1074.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to create directories (API string)","Calls an API typically used to create a directory","Creates directory on disk"],"parent":{"technique":"Data Staged","attck_id":"T1074","attck_id_wiki":"https://attack.mitre.org/techniques/T1074"}},{"tactic":"Collection","technique":"Clipboard Data","attck_id":"T1115","attck_id_wiki":"https://attack.mitre.org/techniques/T1115","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to access clipboard data (API string)"],"parent":null},{"tactic":"Collection","technique":"Data from Local System","attck_id":"T1005","attck_id_wiki":"https://attack.mitre.org/techniques/T1005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Collection","technique":"Data from Information Repositories","attck_id":"T1213","attck_id_wiki":"https://attack.mitre.org/techniques/T1213","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains SQL queries"],"parent":null},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Found potential URL in binary/memory","Found potential URLs in memory dumps","Found potential IP address in binary/memory","Calls an API typically used to create a new HTTP request"],"parent":null},{"tactic":"Command and Control","technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains references to RPC protocol sequence strings"],"parent":null},{"tactic":"Command and Control","technique":"Web Protocols","attck_id":"T1071.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":3,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Found string related to HTTP headers","Found user-agent related strings","Calls an API used to connect to internet"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to use Microsoft's Enhanced Cryptographic Provider"],"parent":null},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attck_id":"T1568.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1568/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["High entropy domain detected"],"parent":{"technique":"Dynamic Resolution","attck_id":"T1568","attck_id_wiki":"https://attack.mitre.org/techniques/T1568"}},{"tactic":"Command and Control","technique":"DNS","attck_id":"T1071.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries DNS server"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attck_id":"T1105","attck_id_wiki":"https://attack.mitre.org/techniques/T1105","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Drops executable files","Writes a PE file header to disc"],"informative_identifiers_count":2,"informative_identifiers":["Dropped files","Contains ability to write files (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Internal Proxy","attck_id":"T1090.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1090/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies proxy settings"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090"}},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attck_id":"T1041","attck_id_wiki":"https://attack.mitre.org/techniques/T1041","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attck_id":"T1029","attck_id_wiki":"https://attack.mitre.org/techniques/T1029","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform scheduled transfer (API string)"],"parent":null},{"tactic":"Impact","technique":"Service Stop","attck_id":"T1489","attck_id_wiki":"https://attack.mitre.org/techniques/T1489","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to retrieve/open a process (API string)","Contains ability to terminate a process (API string)"],"parent":null},{"tactic":"Impact","technique":"System Shutdown/Reboot","attck_id":"T1529","attck_id_wiki":"https://attack.mitre.org/techniques/T1529","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to reboot/shutdown the operating system (API string)"],"parent":null},{"tactic":"Impact","technique":"Data Encrypted for Impact","attck_id":"T1486","attck_id_wiki":"https://attack.mitre.org/techniques/T1486","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to access crypto-related API (String)"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-92","type":2,"relevance":1,"name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")","Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-226","type":2,"relevance":1,"name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","description_v2":["Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp, 00000000-00004800.00000000.241889.72B0E000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp, 00000000-00004800.00000000.241889.72B0E000.00000002.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"CreateTimerQueueTimer\" (Indicator: \"CreateTimerQueueTimer\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp, 00000000-00004800.00000000.241889.72B0E000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp, 00000000-00004800.00000000.241889.72B0E000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateTimerQueueTimer\" (Indicator: \"CreateTimerQueueTimer\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-306","type":2,"relevance":1,"name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","description_v2":["Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")","Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-318","type":2,"relevance":1,"name":"Contains ability to load/free library (API string)","description":"$2a","description_v2":["Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")","Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp, 00000000-00004800.00000000.241889.72B0E000.00000002.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp, 00000000-00004800.00000000.241889.72B0E000.00000002.mdmp\")","Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004800.00000000.241889.72B0E000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp, 00000000-00004800.00000000.241889.72B0E000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp, 00000000-00004800.00000000.241889.72B0E000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004800.00000000.241889.00A74000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004800.00000000.241889.72B0E000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-304","type":2,"relevance":1,"name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")","description_v2":["Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-320","type":2,"relevance":1,"name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")","description_v2":["Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-409","type":2,"relevance":1,"name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")","description_v2":["Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.bin\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"registry-215","type":3,"relevance":7,"name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","description_v2":["\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\")","\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\")","\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\")","\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\PROGID\")","\"BluetoothService.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\")","\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\PROGID\")","\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\INTERNET EXPLORER\\MAIN\\FEATURECONTROL\\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610\")","\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\INTERNET EXPLORER\\MAIN\\FEATURECONTROL\\FEATURE_LOCALMACHINE_LOCKDOWN\")","\"BluetoothService.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\INTERNET EXPLORER\\MAIN\\FEATURECONTROL\\FEATURE_LOCALMACHINE_LOCKDOWN\")","\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\INTERNET EXPLORER\")","\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\INTERNET EXPLORER\")","\"BluetoothService.exe\" (Access type: \"QUERY\"; Path: \"HKCU\\SOFTWARE\")","\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\")","\"BluetoothService.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\")","\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\")","\"BluetoothService.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\")","\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\HVSI\")","\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\SETUP\")"],"description_v3":[{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\PROGID\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\PROGID\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\INTERNET EXPLORER\\MAIN\\FEATURECONTROL\\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\INTERNET EXPLORER\\MAIN\\FEATURECONTROL\\FEATURE_LOCALMACHINE_LOCKDOWN\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\INTERNET EXPLORER\\MAIN\\FEATURECONTROL\\FEATURE_LOCALMACHINE_LOCKDOWN\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\INTERNET EXPLORER\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\INTERNET EXPLORER\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"QUERY\"; Path: \"HKCU\\SOFTWARE\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\HVSI\")"},{"type":"linebreak"},{"type":"text","value":"\"BluetoothService.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\SETUP\")"}],"origin":"Registry Access","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-9","type":6,"relevance":4,"name":"Queries process information","description":"$2c","description_v2":["\"