24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Barys.Generic Sample fa282932f1e6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fa282932f1e6…. Malware family: Barys.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b","keywords":["Malicious","Barys.Generic","malware analysis","sandbox report","threat intelligence","fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b"],"about":{"@type":"SoftwareApplication","name":"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b","applicationCategory":["pedll","executable"],"identifier":"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Barys.Generic","antivirusDetections":{"malicious":13,"total":24},"behavioralIndicators":{"malicious":1,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T544,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp")26:T7d35,Found reference to API (Indicator: "HeapSize"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetLastError"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "HeapFree"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetStdHandle"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "EnterCriticalSection"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "OutputDebugStringW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetModuleFileNameW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetConsoleCP"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetOEMCP"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "IsDebuggerPresent"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "ExitProcess"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "FlsGetValue"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "FlsSetValue"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "FlushFileBuffers"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetModuleFileNameA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "RtlUnwind"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "DeleteCriticalSection"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetCurrentProcess"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "SizeofResource"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetConsoleMode"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetStringTypeW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetFileSize"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "SetLastError"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "LockResource"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "WideCharToMultiByte"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "LoadLibraryExW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "MultiByteToWideChar"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetStartupInfoW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "SetFilePointerEx"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "FlsAlloc"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetCommandLineA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetProcAddress"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "FlsFree"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetProcessHeap"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetTickCount64"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "SetStdHandle"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "WriteFile"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "WriteConsoleW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetCPInfo"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "LoadLibraryW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "SetFilePointer"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "ReadFile"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "CreateDirectoryW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetTempPathW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "CloseHandle"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "DeleteFileW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "TerminateProcess"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetACP"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "HeapReAlloc"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "DecodePointer"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetModuleHandleW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "FreeResource"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "HeapAlloc"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetModuleHandleExW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "IsValidCodePage"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "LoadResource"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "FindResourceW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "CreateFileW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "InterlockedDecrement"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "Sleep"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetFileType"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "EncodePointer"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetCurrentThreadId"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "LeaveCriticalSection"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "LCMapStringEx"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "InterlockedIncrement"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "PathFileExistsW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "MessageBoxW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetActiveWindow"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetLastActivePopup"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetProcessWindowStation"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetUserNameA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "FreeLibrary"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "WaitForSingleObject"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "LoadLibraryA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetLocalTime"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "lstrcatA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "CreateDirectoryA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "DeleteFileA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetTempPathA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "lstrcmpiA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "FindFirstFileA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetComputerNameA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "FindNextFileA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "IsWow64Process"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "GetTickCount"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "CreateFileA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "SHGetSpecialFolderPathA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "StrStrIW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "PathFileExistsA"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "wsprintfW"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "PathFileExistsA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp")27:T6f1,"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10002598,call 0x10004c94,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100025ad,add esp, 0xc,pop ebp,ret 0xc,push 0xc,push 0x1000bc50,call 0x10004f90,xor eax, eax,inc eax,mov esi, dword ptr [ebp + 0xc],test esi, esi,jne 0x100025cf,cmp dword ptr [0x1000dd88], esi,je 0x100026b3,and dword ptr [ebp - 4], 0,cmp esi, 1,je 0x100025dd,cmp esi, 2,jne 0x10002612,mov ecx, dword ptr [0x1000a180],test ecx, ecx,je 0x100025f3,push dword ptr [ebp + 0x10],push esi,push dword ptr [ebp + 8]," "msfltr32.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10003177,call 0x10005d06,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1000318c,add esp, 0xc,pop ebp,ret 0xc,push 0xc,push 0x1000c140,call 0x10006000,xor eax, eax,inc eax,mov esi, dword ptr [ebp + 0xc],test esi, esi,jne 0x100031ae,cmp dword ptr [0x1000e6e8], esi,je 0x10003292,and dword ptr [ebp - 4], 0,cmp esi, 1,je 0x100031bc,cmp esi, 2,jne 0x100031f1,mov ecx, dword ptr [0x1000a1b0],test ecx, ecx,je 0x100031d2,push dword ptr [ebp + 0x10],push esi,push dword ptr [ebp + 8]," "msic.exe" file has an entrypoint instructions - "call 0x4027dc,jmp 0x4012c5,push 0x14,push 0x4089e0,call 0x402a90,call 0x40297c,movzx esi, ax,push 2,call 0x40278f,pop ecx,mov eax, 0x5a4d,cmp word ptr [0x400000], ax,je 0x4012f3,xor ebx, ebx,jmp 0x401326,mov eax, dword ptr [0x40003c],cmp dword ptr [eax + 0x400000], 0x4550,jne 0x4012ef,mov ecx, 0x10b,cmp word ptr [eax + 0x400018], cx,jne 0x4012ef,xor ebx, ebx,cmp dword ptr [eax + 0x400074], 0xe,jbe 0x401326,"28:T706,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "")29:Tbe2,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "RUNDLL32"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "CATEGORY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "NAME"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}"; Key: "PARENTFOLDER"; Value: "")2a:T17a4,Found string "!This program cannot be run in DOS mode.RichO.text`.rdata@.data.rsrc@.relocPRVjSVWfD$ h D$(PD$(P_^[3Wh/uQSPVwFhtSVWhD$0t-NPWj?[_^]oF foF foF foV fo^0fof@fonPfov`fo~pfFGIuFGIuuPVWh"u3tA9M< t8PSt#Hts9qt%OutO95TURPQQhL$,3UVWS[_^]SVWj_^[]tWPVx&;5~';_t|%3wtVj;_tr.WVj9E(jt@WVPP9E uSVW39E WWSVWUj]_^[;t$,v-UQPXY]Y[xy;5(null)( 8PX700WP`h````xpxxxx('8PW700PP`h`hhhxppwppCorExitProcessGetCurrentPackageIdSundayMondayTuesdayWednesdayThursdayFridaySaturdayJanuaryFebruaryMarchAprilJuneJulyAugustSeptemberOctoberNovemberDecemberMM/dd/yydddd, MMMM dd, yyyyHH:mm:ssMessageBoxWGetActiveWindowGetLastActivePopupGetUserObjectInformationWGetProcessWindowStation !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+ -./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~HwjfyjUwthjxxNsyjwsfq\tzynsktC:\Windows\System32\cmd.exe%c:\%s%c.txt/c tree /f %s >> %sm.dll%s%shttp://%s/home/?id=%s&act=wbi&ver=%sC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exetext/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8NsyjwsjyTujsFNsyjwsjyHtssjhyFMyyuTujsWjvzjxyFMyyuXjsiWjvzjxyJ}FMyyuXjsiWjvzjxyFMyyuJsiWjvzjxyFNsyjwsjyWjfiKnqjNsyjwsjy\wnyjKnqjNsyjwsjyHqtxjMfsiqjabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZhttp://Host: %sWebKitFormBoundaryContent-Type: multipart/form-data; boundary=----Origin: http://Cache-Control: max-age=0Host: %s%s%s%s%s%s_%d_%d_%d_%d------%sContent-Disposition: form-data; name="MAX_FILE_SIZE"1000000000------%sContent-Disposition: form-data; name="file"; filename="%s"Content-Type: application/x-zip-compressed------%s--POST%s\%d_%d_%d.xLjyFx~shPj~Xyfyj[SHIFT][ALT][ALT GR][BACKSPACE][TAB][ESC][DEL][WIN][NUM /][NUM +][NUM -][NUM ,][NUM]%s\*%s\%sWjlHwjfyjPj~J}\WjlTujsPj~J}\WjlLjy[fqzj\WjlXjy[fqzjJ}\WjlHqtxjPj~WjlIjqjyj[fqzj\sig.xWyqHwjfyjZxjwYmwjfic.dllc.exeGetComputerNameAGetCurrentProcessIsWow64ProcessFreeLibraryWaitForSingleObjectLoadLibraryWSleepMultiByteToWideCharlstrcmpiALoadLibraryACloseHandleGetTempPathADeleteFileACreateFileAGetFileSizeGetTickCountWriteFileReadFilelstrcatAGetLocalTimeCreateDirectoryAFindFirstFileAFindNextFileASetFilePointerGetModuleHandleWKERNEL32.dllwsprintfWUSER32.dllGetUserNameAADVAPI32.dllSHGetSpecialFolderPathASHELL32.dllPathFileExistsAStrStrAStrStrIWSHLWAPI.dllHeapAllocGetCommandLineAGetCurrentThreadIdIsDebuggerPresentIsProcessorFeaturePresentEncodePointerDecodePointerGetLastErrorInterlockedDecrementExitProcessGetModuleHandleExWGetProcAddressGetStdHandleGetModuleFileNameWGetProcessHeapSetLastErrorInterlockedIncrementGetFileTypeInitializeCriticalSectionAndSpinCountDeleteCriticalSectionInitOnceExecuteOnceGetStartupInfoWGetModuleFileNameAHeapFreeQueryPerformanceCounterGetSystemTimeAsFileTimeGetTickCount64GetEnvironmentStringsWFreeEnvironmentStringsWWideCharToMultiByteUnhandledExceptionFilterSetUnhandledExceptionFilterFlsAllocFlsGetValueFlsSetValueFlsFreeTerminateProcessEnterCriticalSectionLeaveCriticalSectionGetConsoleCPGetConsoleModeSetFilePointerExIsValidCodePageGetACPGetOEMCPGetCPInfoLoadLibraryExWOutputDebugStringWRtlUnwindHeapReAllocSetStdHandleWriteConsoleWGetStringTypeWHeapSizeLCMapStringExFlushFileBuffersCreateFileWKGH_Backdoor.dll abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZHTTP/1.1Accept-Encoding: gzip,deflate,sdchAccept-Language: en-US,en;q=0.8Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.11231.57 Safari/537.36/3489-sd*f/-*g/fd*b/89fg8b2f-g/g-*fhk ynuy8,ui1,j@h62k9jfghj#+hj-f*hj/k9m45fh96f6%94h+9s7f4gh!s8/h/h-*-/j9j87*7hmn84ytmn7yt-ty*n*n/yrkjyulop*told*f-a/sdfs*io-lu*ilo*-i]*[-*opi[;l*uiliu;op'i*o-l-o*l;dfs+dfdgju* uk*iuds*d-fsdf+sdfsd+fhgt*ju*-o98o98-*p09*9*08;9*08lo8,*.*,.o.*csv.posadadesantiago.comhttp://csv.posadadesantiago.com/home/up.php?id=http://csv.posadadesantiago.com/home/?act=news&id=C:\test1.txt 0"0?0L0U0[0b0q0{022E2\2h2y22B3I34-4C4_45#5)5.575<5H5u55r6x67&737A7W7v7828C8M8S8[8879=9X9_9v9}9;>;R;{;< < <1<6<;<@'?2?8?X?`?i?n?t?y?0$060Z0i0x01"111@1O1`1e1l12 222?2Q2^2p2x2303;3K3x35'535<5H5Q5]5f5r5{56-6g6w67O7T7a78&8-8:8:<:V:g:n:;-;L;S;;?p>}>?#?(?4?9?X?+0C0M0i0p0v01=2b2l23C3I3r33 4q4|44k6p6v67L7X78#8F8L8S88#9<9q99[:a:;7 >3>A>O>`>m>v>}>?/?K?Q?1+1I12'242@2P2_2f2w23@3m33>4X4t44g5z56=6L6j6041|11)2B2S2}22=3w35J5W5a5o5x56.6D6W6q6y67*7U7<)<7L>R>\>r>?"?)?W?\?t?}?0+0?0E01X1_1g12P2V2[2g2t2|2253:3C3H3Q3V3c33`4I6Q6V6z67#7)71777=7E7N7U7]7f7x78.8u89W:]:i:;F;g;n;<<=z=>!>:>\>c>10@0_01-1?1Q1c1u15]6?79#9/9s9y99a:m:V?\?3$3 343<3D3L3T3\3d3l3t3081T1X1x12(2H2h23(3H3h3t31T4x9|9: :,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:;$;4;D;d;p;t;x;|;=(=,=0=4=8=<=@=D=L=P=T="; File: "msfltr32.dll") Found string "Content-Type: multipart/form-data; boundary=----"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found string "Content-Disposition: form-data; name="MAX_FILE_SIZE""; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found string "Content-Disposition: form-data; name="file"; filename="%s""; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp")2b:T63d,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp")2c:T557,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00003372.00000000.198235.007B1000.00000020.mdmp")2d:T49c,file/memory contains long string with (Indicator: "[BACKSPACE]"; File: "msfltr32.dll") file/memory contains long string with (Indicator: "[tab]"; File: "msfltr32.dll") file/memory contains long string with (Indicator: "[shift]"; File: "msfltr32.dll") file/memory contains long string with (Indicator: "[alt]"; File: "msfltr32.dll") file/memory contains long string with (Indicator: "[esc]"; File: "msfltr32.dll") file/memory contains long string with (Indicator: "[Alt]"; File: "msfltr32.dll") Found string "[SHIFT]" (Indicator: "[shift]"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found string "[ALT]" (Indicator: "[alt]"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found string "[BACKSPACE]" (Indicator: "[BACKSPACE]"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found string "[TAB]" (Indicator: "[tab]"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp") Found string "[ESC]" (Indicator: "[esc]"; Source: "00000000-00003372.00000000.198235.00160000.00000004.mdmp")2e:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790276765053,"unified_at":"2026-09-24T19:06:05.053Z","metadata":{"hashes":{"sha256":"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b","sha1":"181e5e355a5d8093de0111cf78b6a92705d945d3","md5":"aa9c385cf4900e6855292dda3ea5619a","sha512":"c33428d6f3a9c701a00bf0d1b002377f6883613adb256b0734f09fa1defe595b0850b8c76cc4b8cc01025332caf9db36fc7be1be7c72e6303c55a44afe75d3a7","ssdeep":"3072:HYttVmDn1YfF/MEANF1krgsUvwLFU4uVRywD4B/:HY3wn0fANFMgs8wLFU48R","ssdeep_chunks":["3072:HYttVmD","3072:YttVmDn","3072:ttVmDn1","3072:tVmDn1Y","3072:VmDn1Yf","3072:mDn1YfF","3072:Dn1YfF/","3072:n1YfF/M","3072:1YfF/ME","3072:YfF/MEA","3072:fF/MEAN","3072:F/MEANF","3072:/MEANF1","3072:MEANF1k","3072:EANF1kr","3072:ANF1krg","3072:NF1krgs","3072:F1krgsU","3072:1krgsUv","3072:krgsUvw","3072:rgsUvwL","3072:gsUvwLF","3072:sUvwLFU","3072:UvwLFU4","3072:vwLFU4u","3072:wLFU4uV","3072:LFU4uVR","3072:FU4uVRy","3072:U4uVRyw","3072:4uVRywD","3072:uVRywD4","3072:VRywD4B","3072:RywD4B/","6144:HYttVmD","6144:YttVmDn","6144:ttVmDn1","6144:tVmDn1Y","6144:VmDn1Yf","6144:mDn1YfF","6144:Dn1YfF/","6144:n1YfF/M","6144:1YfF/ME","6144:YfF/MEA","6144:fF/MEAN","6144:F/MEANF","6144:/MEANF1","6144:MEANF1k","6144:EANF1kr","6144:ANF1krg","6144:NF1krgs","6144:F1krgsU","6144:1krgsUv","6144:krgsUvw","6144:rgsUvwL","6144:gsUvwLF","6144:sUvwLFU","6144:UvwLFU4","6144:vwLFU4u","6144:wLFU4uV","6144:LFU4uVR","6144:FU4uVRy","6144:U4uVRyw","6144:4uVRywD","6144:uVRywD4","6144:VRywD4B","6144:RywD4B/","3072:HY3wn0f","3072:Y3wn0fA","3072:3wn0fAN","3072:wn0fANF","3072:n0fANFM","3072:0fANFMg","3072:fANFMgs","3072:ANFMgs8","3072:NFMgs8w","3072:FMgs8wL","3072:Mgs8wLF","3072:gs8wLFU","3072:s8wLFU4","3072:8wLFU48","3072:wLFU48R"],"imphash":"36013ffe92faf81fae86c1f7a4d97fdd"},"file_info":{"file_name":"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b","file_type":["pedll","executable"],"file_type_id":"dll","file_size":140800,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1720400992000,"last_seen":1720400992000,"last_multi_scan":1720400992000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["cobravenomdropper","dropper","targeted","velvetchollima","keylogger"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":41},"sandbox_signatures":{"informative_count":84,"suspicious_count":12,"malicious_count":1,"total":97},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Dropper/Win32.Backdoor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kimsuky","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Barys.625","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Barys.625 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kimsuky.AI trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005727b91 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXMM-ZS!AA9C385CF490","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Casdet.ibtkeq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.HNOK-0639","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Casdet","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Jobutyve.Win32.18","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Barys.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"suspicious","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 58298-144-1000550D\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 58298-144-1000550D\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 58298-89-10006390\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 58298-89-10006390","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.1838392173257555","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\"rundll32.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00003372)\n \"rundll32.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"ElevateCreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: msfltr32.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: msic.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$26","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\" contains export function called \"outinfo\" at ordinal 1\n \"msfltr32.dll\" contains export function called \"out\" at ordinal 1","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"~Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 58298-125-10001000","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"DLL with no export directory","description":"\"msic.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"","origin":"Static Parser","relevance":1,"id":"static-91","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"Process \"rundll32.exe\" with commandline \"\"C:\\\\fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b.dll\",#1\" (UID: 00000000-00003372)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"msfltr32.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"msic.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.11231.57 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75EC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e001022b969@KERNELBASE.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"msfltr32.dll\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"msfltr32.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"msic.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"msic.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\" has an executable section named \".text\"\n \"msfltr32.dll\" has an executable section named \".text\"\n \"msic.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\" has an writable section named \".data\"\n \"msfltr32.dll\" has an writable section named \".data\"\n \"msic.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$27","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"msfltr32.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"msic.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"rundll32.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3f34a.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp, 00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003372.00000000.198235.007B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"msfltr32.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%LOCALAPPDATA%\\AreSoft\\msfltr32.dll]- [targetUID: 00000000-00003372]\n \"msic.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%LOCALAPPDATA%\\AreSoft\\msic.exe]- [targetUID: 00000000-00003372]\n \"3f34a.tmp\" has type \"data\"- Location: [%TEMP%\\3f34a.tmp]- [targetUID: 00000000-00003372]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"3f34a.tmp\" has type \"data\" - Location: [%TEMP%\\3f34a.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"rundll32.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\3f34a.tmp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"rundll32.exe\" trying to touch file \"\\FileSystem\\Filters\\FltMgrMsg\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\sechost.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\rundll32.exe\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\AppPatch\\AcLayers.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\sspicli.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"rundll32.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\FA282932F1E65235DC6B7DBA2B397A155A6ABED9F7BD54AFBC9B636D2F698B4B.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\FA282932F1E65235DC6B7DBA2B397A155A6ABED9F7BD54AFBC9B636D2F698B4B.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\FA282932F1E65235DC6B7DBA2B397A155A6ABED9F7BD54AFBC9B636D2F698B4B.DLL.124.MANIFEST\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"rundll32.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\3f34a.tmp\"\n \"rundll32.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\aresoft\\msic.exe\"\n \"rundll32.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\aresoft\\msfltr32.dll\"\n \"rundll32.exe\" writes file \"%localappdata%\\aresoft\\msfltr32.dll\"\n \"rundll32.exe\" writes file \"%localappdata%\\aresoft\\msic.exe\"\n \"rundll32.exe\" writes file \"%temp%\\3f34a.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"r&.cn\"\n Pattern match: \"http://cache-control\"\n Pattern match: \"8jl1.lux/xk0wucbdo/sxakt;di/m{luxv`e@3d,~hi%euk5mx=rtyxjqk&eukvwuci#puc&&puca{y\"\n Heuristic match: \"f698b4b.dll.2.ma\"\n Pattern match: \"http://%s/home/?id=%s&act=wbi&ver=%s\"\n Heuristic match: \"csv.posadadesantiago.com\"\n Pattern match: \"http://csv.posadadesantiago.com/home/up.php?id=\"\n Pattern match: \"http://csv.posadadesantiago.com/home/?act=news&id=\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://%s/home/?id=%s&act=wbi&ver=%sc:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exetext/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8nsyjwsjytujsfnsyjwsjyhtssjhyfmyyutujswjvzjxyfmyyuxjsiwjvzjxyj\" - Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")\n Found URL \"http://host:\" - Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")\n Found URL \"http://cache-control:\" - Source: \"00000000-00003372.00000000.198235.00160000.00000004.mdmp\")\n Found URL \"http://csv.posadadesantiago.com/home/up.php?id=http://csv.posadadesantiago.com/home/?act=news&id=c:\\test1.txt","command_line":"","normalized_path":"","uid":"00000000-00006020"},{"pid":3372,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b.dll\",#1","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003372","icon":"$2e"}],"all_imported_dlls":["user32.dll","advapi32.dll","oleaut32.dll","msctf.dll","dwmapi.dll","usp10.dll","shlwapi.dll","apphelp.dll","sspicli.dll","shell32.dll","KernelBase.dll","ntdll.dll","uxtheme.dll","nsi.dll","gdi32.dll","api-ms-win-core-synch-l1-2-0.dll","imagehlp.dll","sechost.dll","ole32.dll","userenv.dll","imm32.dll","ws2_32.dll","kernel32.dll","lpk.dll","msvcrt.dll","AcLayers.dll","fltLib.dll","VxSSL32.dll","rpcrt4.dll","profapi.dll","mpr.dll","fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"msfltr32.dll","sha256":"0282e152c5117b8ecfe82550ae681f95e254ee7880ed5fea5867a177b9986824","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"name":"msic.exe","sha256":"e4d28fd7e0fc63429fc199c1b683340f725f0bf9834345174ff0b6a3c0b1f60e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"name":"3f34a.tmp","sha256":"3ffe22d0ef16cda3789cdc0c008a4b11a6698a32f5a0422f0306aad4607530bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"path":"%TEMP%\\3f34a.tmp","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"path":"%LOCALAPPDATA%\\AreSoft\\msic.exe","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]},{"path":"%LOCALAPPDATA%\\AreSoft\\msfltr32.dll","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"668b3c60f8e9d8963102343d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["668b3c60f8e9d8963102343d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Barys.Generic Sample fa282932f1e6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fa282932f1e6…. Malware family: Barys.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b"}],["$","meta","4",{"property":"og:title","content":"Malicious Barys.Generic Sample fa282932f1e6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fa282932f1e6…. Malware family: Barys.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fa282932f1e65235dc6b7dba2b397a155a6abed9f7bd54afbc9b636d2f698b4b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Barys.Generic Sample fa282932f1e6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fa282932f1e6…. Malware family: Barys.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]