8983ffa6da23e0b99ccc58c17b9788c7
Hash
- MD5: 8983ffa6da23e0b99ccc58c17b9788c7
- SHA1: 01cb397c7f056516be83bef2719925d281a10858
- SHA256: d0912a47413338a1a79eef767aa33135f1e3ac66dfb6f6d1c8dbec72c892b985
- First Seen: 2026-05-14
- Last Seen: 2026-05-14
-
1
Related Reports
-
0
Related IOCs
Additional Information
VirusTotal
{
"data": {
"id": "d0912a47413338a1a79eef767aa33135f1e3ac66dfb6f6d1c8dbec72c892b985",
"type": "file",
"links": {
"self": "https://www.virustotal.com/api/v3/files/d0912a47413338a1a79eef767aa33135f1e3ac66dfb6f6d1c8dbec72c892b985"
},
"attributes": {
"first_submission_date": 1771828866,
"last_analysis_date": 1779790122,
"last_analysis_stats": {
"malicious": 51,
"suspicious": 0,
"undetected": 20,
"harmless": 0,
"timeout": 0,
"confirmed-timeout": 0,
"failure": 0,
"type-unsupported": 4
},
"ssdeep": "98304:ai6rqugxbetxibU56PIYbbeeA0DDumKcT/bPG82i5qDC6KwMpZT+Bm3yQyQyb11p:aLrqhKtkHbh/bPl2i5qDC6KwMpZT+Bm5",
"trid": [
{
"file_type": "Win64 Executable (generic)",
"probability": 37.0
},
{
"file_type": "Win16 NE executable (generic)",
"probability": 28.6
},
{
"file_type": "OS/2 Executable (generic)",
"probability": 11.5
},
{
"file_type": "Generic Win/DOS Executable",
"probability": 11.3
},
{
"file_type": "DOS Executable (generic)",
"probability": 11.3
}
],
"total_votes": {
"harmless": 0,
"malicious": 1
},
"type_description": "Win32 EXE",
"creation_date": 1770255722,
"reputation": -52,
"magika": "PEBIN",
"sandbox_verdicts": {
"Zenbox": {
"category": "malicious",
"malware_classification": [
"MALWARE",
"TROJAN",
"EVADER"
],
"sandbox_name": "Zenbox",
"confidence": 76
},
"C2AE": {
"category": "malicious",
"malware_classification": [
"MALWARE",
"STEALER"
],
"sandbox_name": "C2AE",
"malware_names": [
"Injecxor",
"KeyloggerGeneric"
],
"confidence": 50
},
"Dr.Web vxCube": {
"category": "malicious",
"malware_classification": [
"MALWARE"
],
"sandbox_name": "Dr.Web vxCube"
}
},
"names": [
"zqdtx.exe",
"2026-02-23_8983ffa6da23e0b99ccc58c17b9788c7_cobalt-strike_icedid_njrat_satacom_vidar",
"\ub300\uad6d\ubbfc\uc11c\ube44\uc2a4\uad00\ub9ac\uc6b4\uc601\uccb4\uacc4_\ud604\uc7a5\uc810\uac80_\uc99d\uc801(\ucd08\uc548).pif"
],
"meaningful_name": "zqdtx.exe",
"authentihash": "344b73f2a3264c65d1de2b14cade7389e9f5d6bfe394ace3c895a49791547c08",
"type_tags": [
"executable",
"windows",
"win32",
"pe",
"peexe"
],
"type_tag": "peexe",
"md5": "8983ffa6da23e0b99ccc58c17b9788c7",
"last_submission_date": 1771874304,
"tags": [
"spreader",
"detect-debug-environment",
"checks-disk-space",
"64bits",
"peexe",
"long-sleeps",
"self-delete"
],
"last_analysis_results": {
"Bkav": {
"method": "blacklist",
"engine_name": "Bkav",
"engine_version": "8.2.40(8338)",
"engine_update": "20260525",
"category": "malicious",
"result": "W32.Malware.C25D51D8"
},
"Lionic": {
"method": "blacklist",
"engine_name": "Lionic",
"engine_version": "8.16",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan.Win32.Dorifel.b!c"
},
"tehtris": {
"method": "blacklist",
"engine_name": "tehtris",
"engine_version": "v0.1.4",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"ClamAV": {
"method": "blacklist",
"engine_name": "ClamAV",
"engine_version": "1.5.2.0",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"CMC": {
"method": "blacklist",
"engine_name": "CMC",
"engine_version": "2.4.2022.1",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"CAT-QuickHeal": {
"method": "blacklist",
"engine_name": "CAT-QuickHeal",
"engine_version": "22.00",
"engine_update": "20260525",
"category": "undetected",
"result": null
},
"Skyhigh": {
"method": "blacklist",
"engine_name": "Skyhigh",
"engine_version": "v2021.2.0+4045",
"engine_update": "20260525",
"category": "malicious",
"result": "BehavesLike.Win64.Generic.rc"
},
"ALYac": {
"method": "blacklist",
"engine_name": "ALYac",
"engine_version": "2.0.0.10",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan.Agent.429824A"
},
"Cylance": {
"method": "blacklist",
"engine_name": "Cylance",
"engine_version": "3.0.0.0",
"engine_update": "20260521",
"category": "malicious",
"result": "Unsafe"
},
"VIPRE": {
"method": "blacklist",
"engine_name": "VIPRE",
"engine_version": "6.0.0.35",
"engine_update": "20260525",
"category": "malicious",
"result": "Gen:Variant.Doina.72812"
},
"Sangfor": {
"method": "blacklist",
"engine_name": "Sangfor",
"engine_version": "2.22.3.0",
"engine_update": "20260525",
"category": "malicious",
"result": "Dropper.Win32.Kimsuky.Vrfr"
},
"K7AntiVirus": {
"method": "blacklist",
"engine_name": "K7AntiVirus",
"engine_version": "14.54.59615",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan ( 005cde191 )"
},
"BitDefender": {
"method": "blacklist",
"engine_name": "BitDefender",
"engine_version": "7.2",
"engine_update": "20260526",
"category": "malicious",
"result": "Gen:Variant.Doina.72812"
},
"K7GW": {
"method": "blacklist",
"engine_name": "K7GW",
"engine_version": "14.54.59617",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan ( 005cde191 )"
},
"CrowdStrike": {
"method": "blacklist",
"engine_name": "CrowdStrike",
"engine_version": "1.0",
"engine_update": "20251219",
"category": "malicious",
"result": "win/malicious_confidence_100% (W)"
},
"Arcabit": {
"method": "blacklist",
"engine_name": "Arcabit",
"engine_version": "2025.0.0.23",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan.Doina.D11C6C"
},
"VirIT": {
"method": "blacklist",
"engine_name": "VirIT",
"engine_version": "9.5.1214",
"engine_update": "20260525",
"category": "undetected",
"result": null
},
"Symantec": {
"method": "blacklist",
"engine_name": "Symantec",
"engine_version": "1.22.0.0",
"engine_update": "20260525",
"category": "malicious",
"result": "Trojan Horse"
},
"Elastic": {
"method": "blacklist",
"engine_name": "Elastic",
"engine_version": "4.0.261",
"engine_update": "20260525",
"category": "malicious",
"result": "malicious (high confidence)"
},
"ESET-NOD32": {
"method": "blacklist",
"engine_name": "ESET-NOD32",
"engine_version": "18.2.18.0",
"engine_update": "20260526",
"category": "malicious",
"result": "Win64/Kimsuky.CA trojan"
},
"Zoner": {
"method": "blacklist",
"engine_name": "Zoner",
"engine_version": "2.2.2.0",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"TrendMicro-HouseCall": {
"method": "blacklist",
"engine_name": "TrendMicro-HouseCall",
"engine_version": "24.550.0.1002",
"engine_update": "20260526",
"category": "malicious",
"result": "TROJ_FRS.VSNTCA26"
},
"Paloalto": {
"method": "blacklist",
"engine_name": "Paloalto",
"engine_version": "0.9.0.1003",
"engine_update": "20260526",
"category": "malicious",
"result": "generic.ml"
},
"Cynet": {
"method": "blacklist",
"engine_name": "Cynet",
"engine_version": "4.0.3.4",
"engine_update": "20260526",
"category": "malicious",
"result": "Malicious (score: 100)"
},
"Kaspersky": {
"method": "blacklist",
"engine_name": "Kaspersky",
"engine_version": "22.0.1.28",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan-Dropper.Win32.Dorifel.btqv"
},
"Alibaba": {
"method": "blacklist",
"engine_name": "Alibaba",
"engine_version": "0.3.0.5",
"engine_update": "20190527",
"category": "malicious",
"result": "TrojanDropper:Win32/Dorifel.5d4ba0cb"
},
"NANO-Antivirus": {
"method": "blacklist",
"engine_name": "NANO-Antivirus",
"engine_version": "1.0.170.26895",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"SUPERAntiSpyware": {
"method": "blacklist",
"engine_name": "SUPERAntiSpyware",
"engine_version": "5.6.0.1032",
"engine_update": "20260525",
"category": "undetected",
"result": null
},
"MicroWorld-eScan": {
"method": "blacklist",
"engine_name": "MicroWorld-eScan",
"engine_version": "14.0.409.0",
"engine_update": "20260526",
"category": "malicious",
"result": "Gen:Variant.Doina.72812"
},
"Tencent": {
"method": "blacklist",
"engine_name": "Tencent",
"engine_version": "1.0.0.1",
"engine_update": "20260526",
"category": "malicious",
"result": "Malware.Win32.Gencirc.14aa1fc8"
},
"Sophos": {
"method": "blacklist",
"engine_name": "Sophos",
"engine_version": "3.5.1.0",
"engine_update": "20260526",
"category": "malicious",
"result": "Mal/Generic-S"
},
"F-Secure": {
"method": "blacklist",
"engine_name": "F-Secure",
"engine_version": "18.10.1547.307",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan.TR/W32.Kimsuky.AS"
},
"DrWeb": {
"method": "blacklist",
"engine_name": "DrWeb",
"engine_version": "7.0.75.2070",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan.Siggen32.43029"
},
"Zillya": {
"method": "blacklist",
"engine_name": "Zillya",
"engine_version": "2.0.0.5608",
"engine_update": "20260525",
"category": "malicious",
"result": "Trojan.Agent.Win64.175542"
},
"TrendMicro": {
"method": "blacklist",
"engine_name": "TrendMicro",
"engine_version": "24.550.0.1002",
"engine_update": "20260526",
"category": "malicious",
"result": "TROJ_FRS.VSNTCA26"
},
"McAfeeD": {
"method": "blacklist",
"engine_name": "McAfeeD",
"engine_version": "1.2.0.14532",
"engine_update": "20260526",
"category": "malicious",
"result": "ti!D0912A474133"
},
"SentinelOne": {
"method": "blacklist",
"engine_name": "SentinelOne",
"engine_version": "7.6.2.19",
"engine_update": "20260324",
"category": "malicious",
"result": "Static AI - Suspicious PE"
},
"Trapmine": {
"method": "blacklist",
"engine_name": "Trapmine",
"engine_version": "4.0.12.0",
"engine_update": "20260504",
"category": "malicious",
"result": "malicious.high.ml.score"
},
"CTX": {
"method": "blacklist",
"engine_name": "CTX",
"engine_version": "2024.8.29.1",
"engine_update": "20260526",
"category": "malicious",
"result": "exe.trojan.dorifel"
},
"Emsisoft": {
"method": "blacklist",
"engine_name": "Emsisoft",
"engine_version": "2024.8.0.61147",
"engine_update": "20260526",
"category": "malicious",
"result": "Gen:Variant.Doina.72812 (B)"
},
"Ikarus": {
"method": "blacklist",
"engine_name": "Ikarus",
"engine_version": "6.4.16.0",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan-Spy.Agent"
},
"Jiangmin": {
"method": "blacklist",
"engine_name": "Jiangmin",
"engine_version": "16.0.100",
"engine_update": "20260525",
"category": "undetected",
"result": null
},
"Webroot": {
"method": "blacklist",
"engine_name": "Webroot",
"engine_version": "1.9.0.8",
"engine_update": "20250227",
"category": "undetected",
"result": null
},
"Varist": {
"method": "blacklist",
"engine_name": "Varist",
"engine_version": "6.6.1.3",
"engine_update": "20260526",
"category": "malicious",
"result": "W64/ABApplication.RQZS-8129"
},
"Avira": {
"method": "blacklist",
"engine_name": "Avira",
"engine_version": "8.3.3.24",
"engine_update": "20260526",
"category": "malicious",
"result": "TR/W32.Kimsuky.AS"
},
"Antiy-AVL": {
"method": "blacklist",
"engine_name": "Antiy-AVL",
"engine_version": "3.0",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"Kingsoft": {
"method": "blacklist",
"engine_name": "Kingsoft",
"engine_version": "None",
"engine_update": "20260524",
"category": "malicious",
"result": "Win32.Trojan-Dropper.Dorifel.btqv"
},
"Gridinsoft": {
"method": "blacklist",
"engine_name": "Gridinsoft",
"engine_version": "1.0.246.174",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"Xcitium": {
"method": "blacklist",
"engine_name": "Xcitium",
"engine_version": "38677",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"Microsoft": {
"method": "blacklist",
"engine_name": "Microsoft",
"engine_version": "1.1.26040.8",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan:Win32/Egairtigado!rfn"
},
"ViRobot": {
"method": "blacklist",
"engine_name": "ViRobot",
"engine_version": "2014.3.20.0",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan.Win.C.Agent.4429824.A"
},
"ZoneAlarm": {
"method": "blacklist",
"engine_name": "ZoneAlarm",
"engine_version": "6.25-116107039",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"GData": {
"method": "blacklist",
"engine_name": "GData",
"engine_version": "GD:27.44681AVA:64.31308",
"engine_update": "20260526",
"category": "malicious",
"result": "Gen:Variant.Doina.72812"
},
"Google": {
"method": "blacklist",
"engine_name": "Google",
"engine_version": "1779782449",
"engine_update": "20260526",
"category": "malicious",
"result": "Detected"
},
"AhnLab-V3": {
"method": "blacklist",
"engine_name": "AhnLab-V3",
"engine_version": "3.30.0.10666",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan/Win.Wacatac.C5852651"
},
"Acronis": {
"method": "blacklist",
"engine_name": "Acronis",
"engine_version": "1.2.0.121",
"engine_update": "20240328",
"category": "undetected",
"result": null
},
"VBA32": {
"method": "blacklist",
"engine_name": "VBA32",
"engine_version": "5.6.1",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"TACHYON": {
"method": "blacklist",
"engine_name": "TACHYON",
"engine_version": "2026-05-26.02",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"DeepInstinct": {
"method": "blacklist",
"engine_name": "DeepInstinct",
"engine_version": "5.0.0.8",
"engine_update": "20260526",
"category": "malicious",
"result": "MALICIOUS"
},
"Malwarebytes": {
"method": "blacklist",
"engine_name": "Malwarebytes",
"engine_version": "3.1.0.235",
"engine_update": "20260526",
"category": "malicious",
"result": "Malware.AI.4150111841"
},
"Panda": {
"method": "blacklist",
"engine_name": "Panda",
"engine_version": "4.6.4.2",
"engine_update": "20260525",
"category": "undetected",
"result": null
},
"APEX": {
"method": "blacklist",
"engine_name": "APEX",
"engine_version": "6.782",
"engine_update": "20260525",
"category": "malicious",
"result": "Malicious"
},
"Rising": {
"method": "blacklist",
"engine_name": "Rising",
"engine_version": "25.0.0.28",
"engine_update": "20260526",
"category": "malicious",
"result": "[email protected] (RDML:ESqaHnRMi8k5CI1a3iiVdQ)"
},
"Yandex": {
"method": "blacklist",
"engine_name": "Yandex",
"engine_version": "5.5.2.24",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"TrellixENS": {
"method": "blacklist",
"engine_name": "TrellixENS",
"engine_version": "6.0.6.653",
"engine_update": "20260525",
"category": "malicious",
"result": "Artemis!8983FFA6DA23"
},
"huorong": {
"method": "blacklist",
"engine_name": "huorong",
"engine_version": "b8a15cc:b8a15cc:e0fccfc:e0fccfc",
"engine_update": "20260525",
"category": "undetected",
"result": null
},
"MaxSecure": {
"method": "blacklist",
"engine_name": "MaxSecure",
"engine_version": "1.0.0.1",
"engine_update": "20260526",
"category": "malicious",
"result": "Trojan.Malware.255782225.susgen"
},
"Fortinet": {
"method": "blacklist",
"engine_name": "Fortinet",
"engine_version": "7.0.48.0",
"engine_update": "20260526",
"category": "malicious",
"result": "W64/Agent.DQP!tr"
},
"AVG": {
"method": "blacklist",
"engine_name": "AVG",
"engine_version": "23.9.8494.0",
"engine_update": "20260515",
"category": "malicious",
"result": "Win32:Kimsuky-AS [Trj]"
},
"Avast": {
"method": "blacklist",
"engine_name": "Avast",
"engine_version": "23.9.8494.0",
"engine_update": "20260515",
"category": "malicious",
"result": "Win32:Kimsuky-AS [Trj]"
},
"alibabacloud": {
"method": "blacklist",
"engine_name": "alibabacloud",
"engine_version": "2.2.0",
"engine_update": "20250321",
"category": "malicious",
"result": "Trojan:Win/Doina.Gen"
},
"Avast-Mobile": {
"method": "blacklist",
"engine_name": "Avast-Mobile",
"engine_version": "260526-00",
"engine_update": "20260526",
"category": "type-unsupported",
"result": null
},
"SymantecMobileInsight": {
"method": "blacklist",
"engine_name": "SymantecMobileInsight",
"engine_version": "2.0",
"engine_update": "20260123",
"category": "type-unsupported",
"result": null
},
"BitDefenderFalx": {
"method": "blacklist",
"engine_name": "BitDefenderFalx",
"engine_version": "2.0.936",
"engine_update": "20260525",
"category": "type-unsupported",
"result": null
},
"Trustlook": {
"method": "blacklist",
"engine_name": "Trustlook",
"engine_version": "1.0",
"engine_update": "20260526",
"category": "type-unsupported",
"result": null
}
},
"sigma_analysis_results": [
{
"rule_level": "critical",
"rule_id": "02b55b29ddf740930b68c311ca7cd59354f8c35ceda86d09a3fb06f08b760857",
"rule_source": "Joe Security Rule Set (GitHub)",
"rule_title": "Schedule system process",
"rule_description": "Schedule system process",
"rule_author": "Joe Security",
"match_context": [
{
"values": {
"Hashes": "MD5=796B784E98008854C27F4B18D287BA30,SHA256=356280CCA63CA5E887FDBE5CB4105A53341FBAC9219EFC51621DF9BA8EE9838B,IMPHASH=ECCE05491F2E8F279F4790BCB1318C05",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "schtasks.exe",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Task Scheduler Configuration Tool",
"FileVersion": "10.0.19041.906 (WinBuild.160101.0800)",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"CommandLine": "schtasks /create /f /tn \"Storage\\Disk0\\Partition0\" /tr \"C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package'\" /sc minute /mo 5",
"EventID": "1",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\schtasks.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Product": "Microsoft\\xae Windows\\xae Operating System",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "schtasks.exe",
"Hashes": "SHA1=85E046DE3C2DE1B4C85E57BA00CF7151B3D59F24,MD5=D857FA7279E2861199583474C17A1C6C,SHA256=DDDE64F0F55751763C1BCD53DE9CDFFC0D725D45A8476464A2A0422661813004,IMPHASH=44E70F20C235C150D75F6FC8B1E29CD1",
"Description": "Task Scheduler Configuration Tool",
"EventID": "1",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\63DF.tmp\"",
"CommandLine": "schtasks /create /f /tn \"Storage\\Disk0\\Partition0\" /tr \"C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package'\" /sc minute /mo 5",
"FileVersion": "10.0.22621.1 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\schtasks.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"CommandLine": "schtasks /create /f /tn Storage\\Disk0\\Partition0 /tr C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\<USER>\\AppData\\Roaming\\AppRoot\\app.package' /sc minute /mo 5",
"Image": "schtasks",
"EventID": "1"
}
}
]
},
{
"rule_level": "critical",
"rule_id": "c26e0207e75a84b37249afa14659448c57c0203d2220e8049b52775ab00538dc",
"rule_source": "Joe Security Rule Set (GitHub)",
"rule_title": "Schedule REGSVR windows binary",
"rule_description": "Schedule REGSVR windows binary",
"rule_author": "Joe Security",
"match_context": [
{
"values": {
"Hashes": "MD5=796B784E98008854C27F4B18D287BA30,SHA256=356280CCA63CA5E887FDBE5CB4105A53341FBAC9219EFC51621DF9BA8EE9838B,IMPHASH=ECCE05491F2E8F279F4790BCB1318C05",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "schtasks.exe",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Task Scheduler Configuration Tool",
"FileVersion": "10.0.19041.906 (WinBuild.160101.0800)",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"CommandLine": "schtasks /create /f /tn \"Storage\\Disk0\\Partition0\" /tr \"C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package'\" /sc minute /mo 5",
"EventID": "1",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\schtasks.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Product": "Microsoft\\xae Windows\\xae Operating System",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "schtasks.exe",
"Hashes": "SHA1=85E046DE3C2DE1B4C85E57BA00CF7151B3D59F24,MD5=D857FA7279E2861199583474C17A1C6C,SHA256=DDDE64F0F55751763C1BCD53DE9CDFFC0D725D45A8476464A2A0422661813004,IMPHASH=44E70F20C235C150D75F6FC8B1E29CD1",
"Description": "Task Scheduler Configuration Tool",
"EventID": "1",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\63DF.tmp\"",
"CommandLine": "schtasks /create /f /tn \"Storage\\Disk0\\Partition0\" /tr \"C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package'\" /sc minute /mo 5",
"FileVersion": "10.0.22621.1 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\schtasks.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"CommandLine": "schtasks /create /f /tn Storage\\Disk0\\Partition0 /tr C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\<USER>\\AppData\\Roaming\\AppRoot\\app.package' /sc minute /mo 5",
"Image": "schtasks",
"EventID": "1"
}
}
]
},
{
"rule_level": "critical",
"rule_id": "c70694dd88c0a5a32ad8a52ef4ad97a6525c281308ba84e791661580aab19264",
"rule_source": "Joe Security Rule Set (GitHub)",
"rule_title": "Run temp file via regsvr32",
"rule_description": "Run temp file via regsvr32",
"rule_author": "Joe Security",
"match_context": [
{
"values": {
"Hashes": "MD5=B0C2FA35D14A9FAD919E99D9D75E1B9E,SHA256=022CB167A29A32DAE848BE91AEF721C74F1975AF151807DAFCC5ED832DB246B7,IMPHASH=0235FF9A007804882636BCCCFB4D1A2F",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "REGSVR32.EXE",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Microsoft(C) Register Server",
"EventID": "1",
"ParentCommandLine": "\"C:\\Users\\Bruno\\Desktop\\file.exe\" ",
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"FileVersion": "10.0.19041.1 (WinBuild.160101.0800)",
"ParentImage": "C:\\Users\\Bruno\\Desktop\\file.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Hashes": "SHA1=DDDE7FD394416798EB2CDA8B723FAA5ED2BAF6CD,MD5=AF0CDEF5F6ECB9B8EBEF4E480EBAAA5A,SHA256=02779144AF756AAB953F13F9E4D28AB3D01A77EB3962756D74099C06BABF21B1,IMPHASH=939D090D03567FAD6F1AC6F2C641A4B2",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "REGSVR32.EXE",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Microsoft(C) Register Server",
"FileVersion": "10.0.22621.1 (WinBuild.160101.0800)",
"ParentCommandLine": "\"C:\\Users\\Bruno\\Desktop\\executable.exe\"",
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\63DF.tmp\"",
"EventID": "1",
"ParentImage": "C:\\Users\\Bruno\\Desktop\\executable.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- C:\\Users\\<USER>\\AppData\\Local\\Temp\\F55E.tmp",
"Image": "C:\\Windows\\system32\\regsvr32.exe",
"EventID": "1"
}
}
]
},
{
"rule_level": "high",
"rule_id": "7d605643d3d8c564d51574a154eb77dd6009d4c2a39133d7fe93089f5764286b",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Potentially Suspicious Child Process Of Regsvr32",
"rule_description": "Detects potentially suspicious child processes of \"regsvr32.exe\".",
"rule_author": "elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
"match_context": [
{
"values": {
"Hashes": "MD5=796B784E98008854C27F4B18D287BA30,SHA256=356280CCA63CA5E887FDBE5CB4105A53341FBAC9219EFC51621DF9BA8EE9838B,IMPHASH=ECCE05491F2E8F279F4790BCB1318C05",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "schtasks.exe",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Task Scheduler Configuration Tool",
"EventID": "1",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"CommandLine": "schtasks /create /f /tn \"Storage\\Disk0\\Partition0\" /tr \"C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package'\" /sc minute /mo 5",
"FileVersion": "10.0.19041.906 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\schtasks.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Hashes": "SHA1=85E046DE3C2DE1B4C85E57BA00CF7151B3D59F24,MD5=D857FA7279E2861199583474C17A1C6C,SHA256=DDDE64F0F55751763C1BCD53DE9CDFFC0D725D45A8476464A2A0422661813004,IMPHASH=44E70F20C235C150D75F6FC8B1E29CD1",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "schtasks.exe",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Task Scheduler Configuration Tool",
"EventID": "1",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\63DF.tmp\"",
"CommandLine": "schtasks /create /f /tn \"Storage\\Disk0\\Partition0\" /tr \"C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package'\" /sc minute /mo 5",
"FileVersion": "10.0.22621.1 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\schtasks.exe",
"Company": "Microsoft Corporation"
}
}
]
},
{
"rule_level": "high",
"rule_id": "80bbf1ed6106205ab2926430c9634286f976b2fee4357dbacddec45b979a4422",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Windows Shell/Scripting Processes Spawning Suspicious Programs",
"rule_description": "Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.",
"rule_author": "Florian Roth (Nextron Systems), Tim Shelton",
"match_context": [
{
"values": {
"Product": "Microsoft\\xae Windows\\xae Operating System",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "schtasks.exe",
"Hashes": "MD5=796B784E98008854C27F4B18D287BA30,SHA256=356280CCA63CA5E887FDBE5CB4105A53341FBAC9219EFC51621DF9BA8EE9838B,IMPHASH=ECCE05491F2E8F279F4790BCB1318C05",
"Description": "Task Scheduler Configuration Tool",
"EventID": "1",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"CommandLine": "schtasks /create /f /tn \"Storage\\Disk0\\Partition0\" /tr \"C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package'\" /sc minute /mo 5",
"FileVersion": "10.0.19041.906 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\schtasks.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Product": "Microsoft\\xae Windows\\xae Operating System",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "schtasks.exe",
"Hashes": "SHA1=85E046DE3C2DE1B4C85E57BA00CF7151B3D59F24,MD5=D857FA7279E2861199583474C17A1C6C,SHA256=DDDE64F0F55751763C1BCD53DE9CDFFC0D725D45A8476464A2A0422661813004,IMPHASH=44E70F20C235C150D75F6FC8B1E29CD1",
"Description": "Task Scheduler Configuration Tool",
"EventID": "1",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\63DF.tmp\"",
"CommandLine": "schtasks /create /f /tn \"Storage\\Disk0\\Partition0\" /tr \"C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package'\" /sc minute /mo 5",
"FileVersion": "10.0.22621.1 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\schtasks.exe",
"Company": "Microsoft Corporation"
}
}
]
},
{
"rule_level": "high",
"rule_id": "f4143907bd6e32636e7bc2f3b4f1fca7dde5ff6787f10a17b360a798f52c6357",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Uncommon Svchost Command Line Parameter",
"rule_description": "Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.\nThis could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.\n",
"rule_author": "Liran Ravich",
"match_context": [
{
"values": {
"CommandLine": "%WINDIR%\\system32\\svchost.exe",
"Image": "C:\\Windows\\system32\\svchost.exe",
"EventID": "1"
}
}
]
},
{
"rule_level": "high",
"rule_id": "f64c98dfb55189f8f65b8dc8c77a020a4c869933083e1b3ef087e4dba264e864",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Regsvr32 DLL Execution With Suspicious File Extension",
"rule_description": "Detects the execution of REGSVR32.exe with DLL files masquerading as other files",
"rule_author": "Florian Roth (Nextron Systems), frack113",
"match_context": [
{
"values": {
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- C:\\Users\\<USER>\\AppData\\Local\\Temp\\F55E.tmp",
"Image": "C:\\Windows\\system32\\regsvr32.exe",
"EventID": "1"
}
}
]
},
{
"rule_level": "medium",
"rule_id": "047ea96432123c5b2a32816291dc196702b51bd9d49adb2c1673b59dd0018a0c",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "DNS Query Request By Regsvr32.EXE",
"rule_description": "Detects DNS queries initiated by \"Regsvr32.exe\"",
"rule_author": "Dmitriy Lifanov, oscd.community",
"match_context": [
{
"values": {
"QueryStatus": "9003",
"QueryName": "erp.spaceme.p-e.kr",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"EventID": "22"
}
},
{
"values": {
"QueryStatus": "9003",
"QueryName": "cms.spaceyou.o-r.kr",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"EventID": "22"
}
}
]
},
{
"rule_level": "medium",
"rule_id": "0533322c5c44794b71e761cd351a2459aad6e21ae95c9543d4c9fdb3c8fde6c4",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE",
"rule_description": "Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware",
"rule_author": "Florian Roth (Nextron Systems)",
"match_context": [
{
"values": {
"Product": "Microsoft\\xae Windows\\xae Operating System",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "schtasks.exe",
"Hashes": "MD5=796B784E98008854C27F4B18D287BA30,SHA256=356280CCA63CA5E887FDBE5CB4105A53341FBAC9219EFC51621DF9BA8EE9838B,IMPHASH=ECCE05491F2E8F279F4790BCB1318C05",
"Description": "Task Scheduler Configuration Tool",
"EventID": "1",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"CommandLine": "schtasks /create /f /tn \"Storage\\Disk0\\Partition0\" /tr \"C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package'\" /sc minute /mo 5",
"FileVersion": "10.0.19041.906 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\schtasks.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Hashes": "SHA1=85E046DE3C2DE1B4C85E57BA00CF7151B3D59F24,MD5=D857FA7279E2861199583474C17A1C6C,SHA256=DDDE64F0F55751763C1BCD53DE9CDFFC0D725D45A8476464A2A0422661813004,IMPHASH=44E70F20C235C150D75F6FC8B1E29CD1",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "schtasks.exe",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Task Scheduler Configuration Tool",
"EventID": "1",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\63DF.tmp\"",
"CommandLine": "schtasks /create /f /tn \"Storage\\Disk0\\Partition0\" /tr \"C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package'\" /sc minute /mo 5",
"FileVersion": "10.0.22621.1 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\schtasks.exe",
"Company": "Microsoft Corporation"
}
}
]
},
{
"rule_level": "medium",
"rule_id": "16502dbca7468597f52d37ca5a5a0f5c904c43f0ca2b6726d890a67a63b68516",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Unusual Parent Process For Cmd.EXE",
"rule_description": "Detects suspicious parent process for cmd.exe",
"rule_author": "Tim Rauch, Elastic (idea)",
"match_context": [
{
"values": {
"Product": "Microsoft\\xae Windows\\xae Operating System",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "Cmd.Exe",
"Hashes": "MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18",
"Description": "Windows Command Processor",
"FileVersion": "10.0.19041.746 (WinBuild.160101.0800)",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"CommandLine": "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Bruno\\AppData\\Local\\Temp\\23EE.tmp.bat",
"EventID": "1",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\cmd.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Hashes": "MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "Cmd.Exe",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Windows Command Processor",
"EventID": "1",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"CommandLine": "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Bruno\\AppData\\Local\\Temp\\2650.tmp.bat",
"FileVersion": "10.0.19041.746 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\cmd.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Hashes": "SHA1=13E9BB7E85FF9B08C26A440412E5CD5D296C4D35,MD5=5A6BE4D2519515241D0C133A26CF62C0,SHA256=423E0E810A69AACEBA0E5670E58AFF898CF0EBFFAB99CCB46EBB3464C3D2FACB,IMPHASH=D73E39DAB3C8B57AA408073D01254964",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "Cmd.Exe",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Windows Command Processor",
"EventID": "1",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\63DF.tmp\"",
"CommandLine": "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Bruno\\AppData\\Local\\Temp\\3009.tmp.bat",
"FileVersion": "10.0.22621.1635 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\cmd.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Product": "Microsoft\\xae Windows\\xae Operating System",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "Cmd.Exe",
"Hashes": "SHA1=13E9BB7E85FF9B08C26A440412E5CD5D296C4D35,MD5=5A6BE4D2519515241D0C133A26CF62C0,SHA256=423E0E810A69AACEBA0E5670E58AFF898CF0EBFFAB99CCB46EBB3464C3D2FACB,IMPHASH=D73E39DAB3C8B57AA408073D01254964",
"Description": "Windows Command Processor",
"FileVersion": "10.0.22621.1635 (WinBuild.160101.0800)",
"ParentCommandLine": " ",
"CommandLine": "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Bruno\\AppData\\Local\\Temp\\39DE.tmp.bat",
"EventID": "1",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\cmd.exe",
"Company": "Microsoft Corporation"
}
}
]
},
{
"rule_level": "medium",
"rule_id": "49c4c4517c1ca707a5dfadad1b8db8afe6380c4546c944335aee3a1fadcc5542",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Regsvr32 Execution From Potential Suspicious Location",
"rule_description": "Detects execution of regsvr32 where the DLL is located in a potentially suspicious location.",
"rule_author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
"match_context": [
{
"values": {
"Hashes": "MD5=B0C2FA35D14A9FAD919E99D9D75E1B9E,SHA256=022CB167A29A32DAE848BE91AEF721C74F1975AF151807DAFCC5ED832DB246B7,IMPHASH=0235FF9A007804882636BCCCFB4D1A2F",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "REGSVR32.EXE",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Microsoft(C) Register Server",
"EventID": "1",
"ParentCommandLine": "\"C:\\Users\\Bruno\\Desktop\\file.exe\" ",
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"FileVersion": "10.0.19041.1 (WinBuild.160101.0800)",
"ParentImage": "C:\\Users\\Bruno\\Desktop\\file.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Hashes": "MD5=B0C2FA35D14A9FAD919E99D9D75E1B9E,SHA256=022CB167A29A32DAE848BE91AEF721C74F1975AF151807DAFCC5ED832DB246B7,IMPHASH=0235FF9A007804882636BCCCFB4D1A2F",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "REGSVR32.EXE",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Microsoft(C) Register Server",
"FileVersion": "10.0.19041.1 (WinBuild.160101.0800)",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- \"C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package\"",
"EventID": "1",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Hashes": "MD5=B0C2FA35D14A9FAD919E99D9D75E1B9E,SHA256=022CB167A29A32DAE848BE91AEF721C74F1975AF151807DAFCC5ED832DB246B7,IMPHASH=0235FF9A007804882636BCCCFB4D1A2F",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "REGSVR32.EXE",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Microsoft(C) Register Server",
"FileVersion": "10.0.19041.1 (WinBuild.160101.0800)",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- \"C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package\"",
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:r- \"C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package.i\"",
"EventID": "1",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Hashes": "SHA1=DDDE7FD394416798EB2CDA8B723FAA5ED2BAF6CD,MD5=AF0CDEF5F6ECB9B8EBEF4E480EBAAA5A,SHA256=02779144AF756AAB953F13F9E4D28AB3D01A77EB3962756D74099C06BABF21B1,IMPHASH=939D090D03567FAD6F1AC6F2C641A4B2",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "REGSVR32.EXE",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Microsoft(C) Register Server",
"FileVersion": "10.0.22621.1 (WinBuild.160101.0800)",
"ParentCommandLine": "\"C:\\Users\\Bruno\\Desktop\\executable.exe\"",
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\63DF.tmp\"",
"EventID": "1",
"ParentImage": "C:\\Users\\Bruno\\Desktop\\executable.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Product": "Microsoft\\xae Windows\\xae Operating System",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "REGSVR32.EXE",
"Hashes": "SHA1=DDDE7FD394416798EB2CDA8B723FAA5ED2BAF6CD,MD5=AF0CDEF5F6ECB9B8EBEF4E480EBAAA5A,SHA256=02779144AF756AAB953F13F9E4D28AB3D01A77EB3962756D74099C06BABF21B1,IMPHASH=939D090D03567FAD6F1AC6F2C641A4B2",
"Description": "Microsoft(C) Register Server",
"EventID": "1",
"ParentCommandLine": " ",
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- \"C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package\"",
"FileVersion": "10.0.22621.1 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"Company": "Microsoft Corporation"
}
}
]
},
{
"rule_level": "medium",
"rule_id": "683818f24875a562c0b792edd4183d333b6b0b284ca8a88cc47fb2c9ae5b1473",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Unsigned DLL Loaded by Windows Utility",
"rule_description": "Detects windows utilities loading an unsigned or untrusted DLL.\nAdversaries often abuse those programs to proxy execution of malicious code.\n",
"rule_author": "Swachchhanda Shrawan Poudel",
"match_context": [
{
"values": {
"Hashes": "SHA1=B012668FB318DEBBAB2E86B2B4E13A54C84A1C00,MD5=D9BE5226E4DF9B95A09CCCE5EE675F73,SHA256=A32A4C9A747D46462B66E509BAC287ADA2D62854836C2EB3D73D06E79E981AF4,IMPHASH=00000000000000000000000000000000",
"SignatureStatus": "Unavailable",
"Signed": "false",
"ImageLoaded": "C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"EventID": "7"
}
},
{
"values": {
"Hashes": "SHA1=B012668FB318DEBBAB2E86B2B4E13A54C84A1C00,MD5=D9BE5226E4DF9B95A09CCCE5EE675F73,SHA256=A32A4C9A747D46462B66E509BAC287ADA2D62854836C2EB3D73D06E79E981AF4,IMPHASH=00000000000000000000000000000000",
"SignatureStatus": "Unavailable",
"Signed": "false",
"ImageLoaded": "C:\\Users\\Bruno\\AppData\\Local\\Temp\\63DF.tmp",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"EventID": "7"
}
},
{
"values": {
"Hashes": "SHA1=B012668FB318DEBBAB2E86B2B4E13A54C84A1C00,MD5=D9BE5226E4DF9B95A09CCCE5EE675F73,SHA256=A32A4C9A747D46462B66E509BAC287ADA2D62854836C2EB3D73D06E79E981AF4,IMPHASH=00000000000000000000000000000000",
"SignatureStatus": "Unavailable",
"ImageLoaded": "C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package.i",
"Signed": "false",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"EventID": "7"
}
}
]
},
{
"rule_level": "medium",
"rule_id": "c0cdd12b4805f2aebecbc0415332f2594acf1ae6d8d82da086eeac9a84bf0c37",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Regsvr32 DLL Execution With Uncommon Extension",
"rule_description": "Detects a \"regsvr32\" execution where the DLL doesn't contain a common file extension.",
"rule_author": "Florian Roth (Nextron Systems)",
"match_context": [
{
"values": {
"Hashes": "MD5=B0C2FA35D14A9FAD919E99D9D75E1B9E,SHA256=022CB167A29A32DAE848BE91AEF721C74F1975AF151807DAFCC5ED832DB246B7,IMPHASH=0235FF9A007804882636BCCCFB4D1A2F",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "REGSVR32.EXE",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Microsoft(C) Register Server",
"FileVersion": "10.0.19041.1 (WinBuild.160101.0800)",
"ParentCommandLine": "\"C:\\Users\\Bruno\\Desktop\\file.exe\" ",
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"EventID": "1",
"ParentImage": "C:\\Users\\Bruno\\Desktop\\file.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Product": "Microsoft\\xae Windows\\xae Operating System",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "REGSVR32.EXE",
"Hashes": "MD5=B0C2FA35D14A9FAD919E99D9D75E1B9E,SHA256=022CB167A29A32DAE848BE91AEF721C74F1975AF151807DAFCC5ED832DB246B7,IMPHASH=0235FF9A007804882636BCCCFB4D1A2F",
"Description": "Microsoft(C) Register Server",
"EventID": "1",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- \"C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package\"",
"FileVersion": "10.0.19041.1 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Hashes": "MD5=B0C2FA35D14A9FAD919E99D9D75E1B9E,SHA256=022CB167A29A32DAE848BE91AEF721C74F1975AF151807DAFCC5ED832DB246B7,IMPHASH=0235FF9A007804882636BCCCFB4D1A2F",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "REGSVR32.EXE",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Microsoft(C) Register Server",
"FileVersion": "10.0.19041.1 (WinBuild.160101.0800)",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- \"C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package\"",
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:r- \"C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package.i\"",
"EventID": "1",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Hashes": "SHA1=DDDE7FD394416798EB2CDA8B723FAA5ED2BAF6CD,MD5=AF0CDEF5F6ECB9B8EBEF4E480EBAAA5A,SHA256=02779144AF756AAB953F13F9E4D28AB3D01A77EB3962756D74099C06BABF21B1,IMPHASH=939D090D03567FAD6F1AC6F2C641A4B2",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "REGSVR32.EXE",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Microsoft(C) Register Server",
"EventID": "1",
"ParentCommandLine": "\"C:\\Users\\Bruno\\Desktop\\executable.exe\"",
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\63DF.tmp\"",
"FileVersion": "10.0.22621.1 (WinBuild.160101.0800)",
"ParentImage": "C:\\Users\\Bruno\\Desktop\\executable.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Hashes": "SHA1=DDDE7FD394416798EB2CDA8B723FAA5ED2BAF6CD,MD5=AF0CDEF5F6ECB9B8EBEF4E480EBAAA5A,SHA256=02779144AF756AAB953F13F9E4D28AB3D01A77EB3962756D74099C06BABF21B1,IMPHASH=939D090D03567FAD6F1AC6F2C641A4B2",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "REGSVR32.EXE",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Microsoft(C) Register Server",
"FileVersion": "10.0.22621.1 (WinBuild.160101.0800)",
"ParentCommandLine": " ",
"CommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- \"C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package\"",
"EventID": "1",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"Company": "Microsoft Corporation"
}
}
]
},
{
"rule_level": "medium",
"rule_id": "e13498937de9343f50c1e8f315ce602aa238e37e21f3dbb15d3403c25afafe3e",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Files With System Process Name In Unsuspected Locations",
"rule_description": "Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.).\nIt is highly recommended to perform an initial baseline before using this rule in production.\n",
"rule_author": "Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)",
"match_context": [
{
"values": {
"TargetFilename": "%windir%\\system32\\regsvr32.exe"
}
}
]
},
{
"rule_level": "low",
"rule_id": "1c2e4db94ca79f939e94e29c04fb3b71467fc6f5b9c31db34fcce5a2fb3b856f",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Non Interactive PowerShell Process Spawned",
"rule_description": "Detects non-interactive PowerShell activity by looking at the \"powershell\" process with a non-user GUI process such as \"explorer.exe\" as a parent.",
"rule_author": "Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)",
"match_context": [
{
"values": {
"CommandLine": "%WINDIR%\\system32\\windowspowershell\\v1.0\\powershell.exe",
"Image": "C:\\Windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
"EventID": "1"
}
}
]
},
{
"rule_level": "low",
"rule_id": "3bc9d14114a6b67367a24df21134d0564d6f08a0ad903d68f9b25e9d8b7f0790",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Scheduled Task Creation Via Schtasks.EXE",
"rule_description": "Detects the creation of scheduled tasks by user accounts via the \"schtasks\" utility.",
"rule_author": "Florian Roth (Nextron Systems)",
"match_context": [
{
"values": {
"Hashes": "MD5=796B784E98008854C27F4B18D287BA30,SHA256=356280CCA63CA5E887FDBE5CB4105A53341FBAC9219EFC51621DF9BA8EE9838B,IMPHASH=ECCE05491F2E8F279F4790BCB1318C05",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "schtasks.exe",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Task Scheduler Configuration Tool",
"EventID": "1",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\CD81.tmp\"",
"CommandLine": "schtasks /create /f /tn \"Storage\\Disk0\\Partition0\" /tr \"C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package'\" /sc minute /mo 5",
"FileVersion": "10.0.19041.906 (WinBuild.160101.0800)",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\schtasks.exe",
"Company": "Microsoft Corporation"
}
},
{
"values": {
"Hashes": "SHA1=85E046DE3C2DE1B4C85E57BA00CF7151B3D59F24,MD5=D857FA7279E2861199583474C17A1C6C,SHA256=DDDE64F0F55751763C1BCD53DE9CDFFC0D725D45A8476464A2A0422661813004,IMPHASH=44E70F20C235C150D75F6FC8B1E29CD1",
"CurrentDirectory": "C:\\Users\\Bruno\\Desktop\\",
"OriginalFileName": "schtasks.exe",
"Product": "Microsoft\\xae Windows\\xae Operating System",
"Description": "Task Scheduler Configuration Tool",
"FileVersion": "10.0.22621.1 (WinBuild.160101.0800)",
"ParentCommandLine": "C:\\Windows\\system32\\regsvr32.exe /s /n /i:a- \"C:\\Users\\Bruno\\AppData\\Local\\Temp\\63DF.tmp\"",
"CommandLine": "schtasks /create /f /tn \"Storage\\Disk0\\Partition0\" /tr \"C:\\Windows\\system32\\regsvr32.exe /s /n /i:i- 'C:\\Users\\Bruno\\AppData\\Roaming\\AppRoot\\app.package'\" /sc minute /mo 5",
"EventID": "1",
"ParentImage": "C:\\Windows\\System32\\regsvr32.exe",
"IntegrityLevel": "High",
"Image": "C:\\Windows\\System32\\schtasks.exe",
"Company": "Microsoft Corporation"
}
}
]
}
],
"sigma_analysis_stats": {
"critical": 3,
"high": 4,
"medium": 7,
"low": 2
},
"vhash": "046076655d755515555az55!z",
"times_submitted": 5,
"unique_sources": 2,
"size": 4429824,
"tlsh": "T19426126870B50CA7F1AEB23288820142F522FC5187725AB727D377625F3A9D0AE35F1D",
"pe_info": {
"timestamp": 1770255722,
"imphash": "493a34a7888701ba98c276d37b66a9a5",
"machine_type": 34404,
"entry_point": 137596,
"resource_details": [
{
"lang": "ENGLISH US",
"chi2": 4031.47,
"filetype": "XML",
"entropy": 4.911615371704102,
"sha256": "4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df",
"type": "RT_MANIFEST"
}
],
"resource_langs": {
"ENGLISH US": 1
},
"resource_types": {
"RT_MANIFEST": 1
},
"sections": [
{
"name": ".text",
"chi2": 2217464.25,
"virtual_address": 4096,
"flags": "rx",
"raw_size": 297472,
"entropy": 6.35,
"virtual_size": 297240,
"md5": "8c487d94a95b544325934a5be617b778"
},
{
"name": ".rdata",
"chi2": 3301754.25,
"virtual_address": 303104,
"flags": "r",
"raw_size": 114688,
"entropy": 5.77,
"virtual_size": 114272,
"md5": "ffcc5f1e95be3f360e746f4a78bae4ed"
},
{
"name": ".data",
"chi2": 128413.0,
"virtual_address": 417792,
"flags": "rw",
"raw_size": 4003328,
"entropy": 7.98,
"virtual_size": 4009908,
"md5": "047c0043fdb823a40fc3854e1693ceca"
},
{
"name": ".pdata",
"chi2": 232841.44,
"virtual_address": 4427776,
"flags": "r",
"raw_size": 9728,
"entropy": 5.6,
"virtual_size": 9684,
"md5": "f497a118151f93edfc2ce39894b71d7f"
},
{
"name": "_RDATA",
"chi2": 36487.0,
"virtual_address": 4440064,
"flags": "r",
"raw_size": 512,
"entropy": 3.31,
"virtual_size": 348,
"md5": "cce6f7cc5160f798fcee1fe6d2f7fd58"
},
{
"name": ".rsrc",
"chi2": 9292.0,
"virtual_address": 4444160,
"flags": "r",
"raw_size": 512,
"entropy": 4.72,
"virtual_size": 480,
"md5": "e11090577a83528f1b6ddad40f142628"
},
{
"name": ".reloc",
"chi2": 19947.39,
"virtual_address": 4448256,
"flags": "r",
"raw_size": 2560,
"entropy": 5.3,
"virtual_size": 2364,
"md5": "d0a6530cb6396530408a2aba16bf790a"
}
],
"compiler_product_versions": [
"[ C ] VS2022 v17.1.0 pre 1.0 build 30818 count=18",
"[ASM] VS2022 v17.1.0 pre 1.0 build 30818 count=10",
"[C++] VS2022 v17.1.0 pre 1.0 build 30818 count=84",
"[---] Unmarked objects count=157",
"[LT+] VS2022 v17.1.0 pre 5.0 build 31104 count=7",
"[RES] VS2022 v17.1.0 pre 5.0 build 31104 count=1",
"[LNK] VS2022 v17.1.0 pre 5.0 build 31104 count=1",
"id: 0x103, version: 27412 count=10",
"id: 0x105, version: 27412 count=181",
"id: 0x107, version: 27412 count=2",
"id: 0x104, version: 27412 count=20",
"id: 0x101, version: 27412 count=17"
],
"rich_pe_header_hash": "ac16b08729c5fb1a00dd5d862db3c208",
"import_list": [
{
"library_name": "KERNEL32.dll",
"imported_functions": [
"CloseHandle",
"CreateEventW",
"CreateFileW",
"CreateThread",
"DecodePointer",
"DeleteCriticalSection",
"EncodePointer",
"EnterCriticalSection",
"EnumSystemLocalesW",
"ExitProcess",
"FindClose",
"FindFirstFileExW",
"FindNextFileW",
"FlushFileBuffers",
"FreeEnvironmentStringsW",
"FreeLibrary",
"GetACP",
"GetCommandLineA",
"GetCommandLineW",
"GetConsoleMode",
"GetConsoleOutputCP",
"GetCPInfo",
"GetCurrentProcess",
"GetCurrentProcessId",
"GetCurrentThreadId",
"GetEnvironmentStringsW",
"GetFileSizeEx",
"GetFileType",
"GetLastError",
"GetLocaleInfoW",
"GetModuleFileNameW",
"GetModuleHandleExW",
"GetModuleHandleW",
"GetOEMCP",
"GetProcAddress",
"GetProcessHeap",
"GetStartupInfoW",
"GetStdHandle",
"GetStringTypeW",
"GetSystemTimeAsFileTime",
"GetUserDefaultLCID",
"HeapAlloc",
"HeapFree",
"HeapReAlloc",
"HeapSize",
"InitializeCriticalSectionAndSpinCount",
"InitializeCriticalSectionEx",
"InitializeSListHead",
"IsDebuggerPresent",
"IsProcessorFeaturePresent",
"IsValidCodePage",
"IsValidLocale",
"LCMapStringEx",
"LCMapStringW",
"LeaveCriticalSection",
"LoadLibraryExW",
"LoadLibraryW",
"MultiByteToWideChar",
"OutputDebugStringW",
"QueryPerformanceCounter",
"RaiseException",
"ReadConsoleW",
"ReadFile",
"ResetEvent",
"RtlCaptureContext",
"RtlLookupFunctionEntry",
"RtlPcToFileHeader",
"RtlUnwind",
"RtlUnwindEx",
"RtlVirtualUnwind",
"SetEvent",
"SetFilePointerEx",
"SetLastError",
"SetStdHandle",
"SetUnhandledExceptionFilter",
"TerminateProcess",
"TlsAlloc",
"TlsFree",
"TlsGetValue",
"TlsSetValue",
"UnhandledExceptionFilter",
"WaitForSingleObjectEx",
"WideCharToMultiByte",
"WriteConsoleW",
"WriteFile"
]
}
]
},
"sha256": "d0912a47413338a1a79eef767aa33135f1e3ac66dfb6f6d1c8dbec72c892b985",
"popular_threat_classification": {
"suggested_threat_label": "trojan.doina/kimsuky",
"popular_threat_category": [
{
"count": 22,
"value": "trojan"
},
{
"count": 4,
"value": "dropper"
}
],
"popular_threat_name": [
{
"count": 7,
"value": "doina"
},
{
"count": 6,
"value": "kimsuky"
},
{
"count": 5,
"value": "dorifel"
}
]
},
"sha1": "01cb397c7f056516be83bef2719925d281a10858",
"magic": "PE32+ executable (GUI) x86-64, for MS Windows",
"sigma_analysis_summary": {
"Joe Security Rule Set (GitHub)": {
"critical": 3,
"high": 0,
"medium": 0,
"low": 0
},
"Sigma Integrated Rule Set (GitHub)": {
"critical": 0,
"high": 4,
"medium": 7,
"low": 2
}
},
"last_modification_date": 1779797351,
"filecondis": {
"raw_md5": "aa10abf23000a6d0d5ac6450e03cc524",
"dhash": "0000001e1e0e1500"
},
"detectiteasy": {
"filetype": "PE64",
"values": [
{
"info": "LTCG/C++",
"version": "19.31.31104",
"type": "Compiler",
"name": "Microsoft Visual C/C++"
},
{
"version": "14.31.31104",
"type": "Linker",
"name": "Microsoft Linker"
},
{
"version": "2022 version 17.1",
"type": "Tool",
"name": "Visual Studio"
}
]
},
"type_extension": "exe"
}
}
}
Related Reports
2026-05-14
Kaspersky