{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9990401864051819, "class": 1 } ], "prob": 0.9990402, "class": 1, "models": [ { "m": "az", "prob": 0.99902415, "class": 1 }, { "m": "az/native", "prob": 0.99902856, "class": 0 }, { "m": "az/pe", "prob": 0.9990402, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9958679, 0.99937946 ], "analyzed_at": "2026-05-05T06:38:12Z" }, "path": "virussign.com_75055681acee4098daf34250c61c75e0.vir", "raw": { "v": "4", "fs": [ { "f": "KO₁₃(Al₅As₁₂C₇Er₁₂P₅Dy₅I₆CoEu₂LaPrSXe₂)H₈(Cm₆Db₄F₇Os₁₁Po₉CrDsMg)Md₂(Bi₅Si)", "k": { "pe.has_pogo": true, "pe.timestamp": 1763903378, "build.username": "decel", "hashes.imphash": "867ce49e8fb03858a7a6603e209d4b6b", "build.user_home": "C:\\Users\\decel", "build.build_root": "C:\\Users\\decel\\vcpkg\\buildtrees", "build.target_arch": "x86_64", "pe.linker_version": "14.44", "build.username_from": "byte_scan", "pe.resource_types[0]": "RT_VERSION", "pe.resource_types[1]": "RT_MANIFEST", "build.source_paths[0]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google", "build.source_paths[1]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\generated_message_tctable_lite.cc", "build.source_paths[2]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\io\\coded_stream.cc", "build.source_paths[3]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\arena.cc", "build.source_paths[4]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\wire_format_lite.cc", "build.source_paths[5]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\message_lite.cc", "build.source_paths[6]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\io\\zero_copy_stream.cc", "build.source_paths[7]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\extension_set.cc", "build.source_paths[8]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\io\\zero_copy_stream_impl_lite.cc", "build.source_paths[9]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\message.cc", "build.source_paths[10]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\generated_message_reflection.cc", "build.source_paths[11]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\wire_format.cc", "build.source_paths[12]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\descriptor.cc", "build.source_paths[13]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\text_format.cc", "build.source_paths[14]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\dynamic_message.cc", "build.source_paths[15]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\reflection_ops.cc", "build.source_paths[16]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\extension_set_heavy.cc", "build.source_paths[17]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\generated_message_tctable_gen.cc", "build.source_paths[18]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\descriptor_database.cc", "build.source_paths[19]": "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\feature_resolver.cc", "build.source_paths[20]": "C:\\Users\\decel\\vcpkg\\buildtrees\\abseil\\src\\20250127.1-a0a219bf72.clean\\absl\\strings\\internal\\cord_rep_btree.cc", "build.source_paths[21]": "C:\\Users\\decel\\vcpkg\\buildtrees\\abseil\\src\\20250127.1-a0a219bf72.clean\\absl\\log\\internal\\log_sink_set.cc", "build.source_paths[22]": "C:\\Users\\decel\\vcpkg\\buildtrees\\abseil\\src\\20250127.1-a0a219bf72.clean\\absl\\container\\internal\\raw_hash_set.cc", "build.source_paths[23]": "C:\\Users\\decel\\vcpkg\\buildtrees\\abseil\\src\\20250127.1-a0a219bf72.clean\\absl\\status\\statusor.cc", "build.source_paths[24]": "C:\\Users\\decel\\vcpkg\\buildtrees\\abseil\\src\\20250127.1-a0a219bf72.clean\\absl\\strings\\escaping.cc", "build.source_paths[25]": "C:\\Users\\decel\\vcpkg\\buildtrees\\abseil\\src\\20250127.1-a0a219bf72.clean\\absl\\strings\\substitute.cc", "build.source_paths[26]": "C:\\Users\\decel\\vcpkg\\buildtrees\\abseil\\src\\20250127.1-a0a219bf72.clean\\absl\\synchronization\\mutex.cc", "build.source_paths[27]": "C:\\Users\\decel\\vcpkg\\buildtrees\\abseil\\src\\20250127.1-a0a219bf72.clean\\absl\\synchronization\\internal\\win32_waiter.cc", "build.source_paths[28]": "C:\\Users\\decel\\vcpkg\\buildtrees\\abseil\\src\\20250127.1-a0a219bf72.clean\\absl\\base\\internal\\low_level_alloc.cc", "pe.rich_header.xor_key": "0x0f6b825f", "hashes.rich_header_hash": "ade5902297a165a379fc141a8a6a15948f1821307c5facc9db7b0f4b41fcbe38", "pe.debug_entries[0].size": 1132, "pe.debug_entries[0].type": "pogo", "pe.tls_callbacks[0].addr": "0x140148ae4", "pe.tls_callbacks[1].addr": "0x14018d5bc", "pe.debug_directory_types[0]": 13, "pe.debug_entries[0].timestamp": 1763903378, "pe.load_config.cfg_check_func": "0x140197778", "pe.load_config.cfg_guard_flags": "0x100", "pe.load_config.security_cookie": "0x1401f2240", "binary.top_complex_unnamed[0].cc": 119, "binary.top_complex_unnamed[1].cc": 68, "binary.top_complex_unnamed[2].cc": 43, "binary.top_complex_unnamed[3].cc": 37, "binary.top_complex_unnamed[4].cc": 31, "binary.top_complex_unnamed[5].cc": 30, "binary.top_complex_unnamed[6].cc": 23, "binary.top_complex_unnamed[7].cc": 23, "pe.dll_characteristics.nx_compat": true, "binary.top_complex_unnamed[0].bbs": 81, "binary.top_complex_unnamed[1].bbs": 111, "binary.top_complex_unnamed[2].bbs": 56, "binary.top_complex_unnamed[3].bbs": 60, "binary.top_complex_unnamed[4].bbs": 42, "binary.top_complex_unnamed[5].bbs": 45, "binary.top_complex_unnamed[6].bbs": 45, "binary.top_complex_unnamed[7].bbs": 33, "binary.top_complex_unnamed[0].addr": "0x14018d770", "binary.top_complex_unnamed[0].size": 1661, "binary.top_complex_unnamed[1].addr": "0x14002c080", "binary.top_complex_unnamed[1].size": 2706, "binary.top_complex_unnamed[2].addr": "0x1400d6905", "binary.top_complex_unnamed[2].size": 1174, "binary.top_complex_unnamed[3].addr": "0x140038140", "binary.top_complex_unnamed[3].size": 1805, "binary.top_complex_unnamed[4].addr": "0x14001fd3f", "binary.top_complex_unnamed[4].size": 628, "binary.top_complex_unnamed[5].addr": "0x14012a787", "binary.top_complex_unnamed[5].size": 542, "binary.top_complex_unnamed[6].addr": "0x1400d1eff", "binary.top_complex_unnamed[6].size": 995, "binary.top_complex_unnamed[7].addr": "0x140160848", "binary.top_complex_unnamed[7].size": 666, "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 8, "pe.rich_header.entries[1].use_count": 17, "pe.rich_header.entries[2].use_count": 12, "pe.rich_header.entries[3].use_count": 114, "pe.rich_header.entries[4].use_count": 24, "pe.rich_header.entries[5].use_count": 199, "pe.rich_header.entries[6].use_count": 278, "pe.rich_header.entries[7].use_count": 31, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 134, "pe.rich_header.entries[0].product_id": 259, "pe.rich_header.entries[10].use_count": 22, "pe.rich_header.entries[11].use_count": 1, "pe.rich_header.entries[12].use_count": 1, "pe.rich_header.entries[1].product_id": 260, "pe.rich_header.entries[2].product_id": 259, "pe.rich_header.entries[3].product_id": 261, "pe.rich_header.entries[4].product_id": 260, "pe.rich_header.entries[5].product_id": 261, "pe.rich_header.entries[6].product_id": 1, "pe.rich_header.entries[7].product_id": 257, "pe.rich_header.entries[8].product_id": 260, "pe.rich_header.entries[9].product_id": 261, "pe.load_config.cfg_flags.instrumented": true, "pe.manifest.requested_execution_level": "asInvoker", "pe.rich_header.entries[10].product_id": 261, "pe.rich_header.entries[11].product_id": 255, "pe.rich_header.entries[12].product_id": 258, "pe.dll_characteristics.high_entropy_va": true, "pe.rich_header.entries[0].build_number": 28900, "pe.rich_header.entries[0].product_name": "Cvtres_VS2013", "pe.rich_header.entries[1].build_number": 35207, "pe.rich_header.entries[1].product_name": "C_VS2015", "pe.rich_header.entries[2].build_number": 35207, "pe.rich_header.entries[2].product_name": "Cvtres_VS2013", "pe.rich_header.entries[3].build_number": 35207, "pe.rich_header.entries[3].product_name": "Cpp_VS2015", "pe.rich_header.entries[4].build_number": 28900, "pe.rich_header.entries[4].product_name": "C_VS2015", "pe.rich_header.entries[5].build_number": 28900, "pe.rich_header.entries[5].product_name": "Cpp_VS2015", "pe.rich_header.entries[6].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[7].build_number": 28900, "pe.rich_header.entries[7].product_name": "Linker_VS2013", "pe.rich_header.entries[8].build_number": 34123, "pe.rich_header.entries[8].product_name": "C_VS2015", "pe.rich_header.entries[9].build_number": 34123, "pe.rich_header.entries[9].product_name": "Cpp_VS2015", "pe.rich_header.entries[10].build_number": 35213, "pe.rich_header.entries[10].product_name": "Cpp_VS2015", "pe.rich_header.entries[11].build_number": 35213, "pe.rich_header.entries[11].product_name": "C_VS2013", "pe.rich_header.entries[12].build_number": 35213, "pe.rich_header.entries[12].product_name": "Linker_VS2013_LTCG", "pe.dll_characteristics.terminal_server_aware": true }, "x": 252, "id": 0, "is": [ "ORDINAL 111", "ORDINAL 3", "ORDINAL 115", "ORDINAL 23", "ORDINAL 4", "ORDINAL 16", "ORDINAL 14", "ORDINAL 8", "freeaddrinfo", "getaddrinfo", "ORDINAL 19", "MFEnumDeviceSources", "MFShutdown", "MFCreateAttributes", "MFCreateMediaType", "MFStartup", "MFCreateSourceReaderFromMediaSource", "WinHttpOpen", "WinHttpCloseHandle", "WinHttpConnect", "WinHttpReceiveResponse", "WinHttpSendRequest", "WinHttpOpenRequest", "WinHttpSetTimeouts", "WinHttpReadData", "GetAdaptersAddresses", "CoInitialize", "PropVariantClear", "CoCreateInstance", "CoSetProxyBlanket", "CoTaskMemFree", "CoUninitialize", "CoInitializeSecurity", "CoInitializeEx", "ORDINAL 2", "ORDINAL 6", "ORDINAL 9", "D3D11CreateDevice", "GetFileVersionInfoW", "GetFileVersionInfoSizeW", "VerQueryValueW", "OutputDebugStringA", "GetLogicalProcessorInformation", "HeapSize", "WriteConsoleW", "GetProcessHeap", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetOEMCP", "GetModuleHandleA", "IsValidCodePage", "SetEndOfFile", "SetStdHandle", "HeapReAlloc", "GetTimeZoneInformation", "SetFilePointerEx", "GetFileSizeEx", "FlushFileBuffers", "EnumSystemLocalesW", "GetUserDefaultLCID", "GetACP", "InitializeSRWLock", "IsValidLocale", "GetLocaleInfoW", "LCMapStringW", "CompareStringW", "GetTimeFormatW", "GetDateFormatW", "FlsFree", "FlsSetValue", "FlsGetValue", "FlsAlloc", "HeapFree", "HeapAlloc", "GetCommandLineW", "GetCommandLineA", "GetStdHandle", "ReadConsoleW", "CloseHandle", "ExitProcess", "CreateProcessW", "GetModuleFileNameW", "GetDiskFreeSpaceExA", "GetLogicalDrives", "GetTempPathA", "MultiByteToWideChar", "WideCharToMultiByte", "GetLastError", "GlobalMemoryStatusEx", "GetVersionExW", "GetProductInfo", "GetModuleHandleW", "InitializeConditionVariable", "LoadLibraryA", "GetComputerNameA", "CreateFileW", "SetFileTime", "CreateProcessA", "OpenProcess", "CreateFileMappingW", "MapViewOfFile", "UnmapViewOfFile", "GetModuleFileNameA", "SystemTimeToFileTime", "K32GetModuleFileNameExW", "CreateToolhelp32Snapshot", "Process32FirstW", "Process32NextW", "ReadFile", "WriteFile", "SetHandleInformation", "CreatePipe", "TerminateProcess", "GetFullPathNameA", "WaitForSingleObject", "GetExitCodeProcess", "CopyFileA", "SetConsoleOutputCP", "FindResourceExW", "FreeLibrary", "FreeResource", "LoadLibraryExW", "LoadResource", "LockResource", "SizeofResource", "FindResourceW", "EnumResourceNamesW", "EnumResourceLanguagesW", "BeginUpdateResourceW", "UpdateResourceW", "EndUpdateResourceW", "Sleep", "GetCurrentDirectoryW", "FindClose", "FindFirstFileW", "FindNextFileW", "SetLastError", "GetDriveTypeW", "GetFileType", "SetEnvironmentVariableW", "GetConsoleMode", "GetConsoleOutputCP", "FreeLibraryAndExitThread", "ExitThread", "CreateThread", "TlsFree", "RtlUnwind", "GetSystemInfo", "VirtualAlloc", "GetProcAddress", "TlsSetValue", "TlsGetValue", "TlsAlloc", "InitializeCriticalSectionAndSpinCount", "FormatMessageA", "LocalFree", "GetLocaleInfoEx", "RtlPcToFileHeader", "RaiseException", "InitOnceBeginInitialize", "InitOnceComplete", "QueryPerformanceCounter", "QueryPerformanceFrequency", "ReleaseSRWLockExclusive", "AcquireSRWLockExclusive", "TryAcquireSRWLockExclusive", "SleepConditionVariableSRW", "GetCurrentThreadId", "WakeConditionVariable", "WakeAllConditionVariable", "CreateDirectoryW", "FindFirstFileExW", "GetFileAttributesW", "GetFileAttributesExW", "GetFullPathNameW", "SetFileInformationByHandle", "GetTempPathW", "AreFileApisANSI", "MoveFileExW", "GetFileInformationByHandleEx", "FreeLibraryWhenCallbackReturns", "CreateThreadpoolWork", "SubmitThreadpoolWork", "CloseThreadpoolWork", "GetModuleHandleExW", "IsProcessorFeaturePresent", "WaitForSingleObjectEx", "SwitchToThread", "GetExitCodeThread", "GetStringTypeW", "EnterCriticalSection", "LeaveCriticalSection", "InitializeCriticalSectionEx", "DeleteCriticalSection", "EncodePointer", "DecodePointer", "LCMapStringEx", "GetSystemTimeAsFileTime", "CompareStringEx", "GetCPInfo", "RtlCaptureContext", "RtlLookupFunctionEntry", "RtlVirtualUnwind", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "GetCurrentProcess", "IsDebuggerPresent", "GetStartupInfoW", "GetCurrentProcessId", "InitializeSListHead", "RtlUnwindEx", "LoadStringW", "EnumDisplayMonitors", "SendInput", "GetSystemMetrics", "GetMonitorInfoW", "ShellExecuteA", "SHGetFolderPathA", "ShellExecuteExW", "CheckTokenMembership", "AllocateAndInitializeSid", "GetUserNameA", "FreeSid", "SymFromAddr" ], "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "has_pogo": true, "rsrc_size": 2560.0, "subsystem": 3.0, "timestamp": 1763903378.0, "image_base": 5368709120.0, "rsrc_entropy": 3.35, "entry_section": ".text", "size_of_image": 2183168.0, "timestamp_day": 23.0, "tls_callbacks": 2.0, "cfg_check_func": 5370378104.0, "file_alignment": 512.0, "resource_count": 2.0, "resource_types": [ "RT_VERSION", "RT_MANIFEST" ], "timestamp_year": 2025.0, "cfg_guard_flags": 256.0, "characteristics": 34.0, "entry_point_rva": 1349040.0, "security_cookie": 5370749504.0, "size_of_headers": 1024.0, "timestamp_month": 11.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 15.0, "manifest_present": true, "computed_checksum": 6351435.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1763903378.0, "debug_timestamp_min": 1763903378.0, "dll_characteristics": 33120.0, "rich_header_present": true, "linker_major_version": 14.0, "linker_minor_version": 44.0, "version_info_present": true, "debug_directory_types": [ 13.0 ], "api_hashing_indicators": 1.0, "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "file": { "size": 6297248.0 }, "binary": { "code_size": 1662976.0, "func_count": 6422.0, "entry_point": 1349040.0, "has_overlay": true, "code_entropy": 6.45, "data_entropy": 5.36, "func_density": 3.95, "import_count": 224.0, "overlay_size": 4147872.0, "string_count": 4135.0, "avg_func_size": 1107.59, "overlay_ratio": 0.66, "section_count": 6.0, "avg_complexity": 7.76, "import_density": 0.14, "max_complexity": 119.0, "string_density": 2.55, "overall_entropy": 5.22, "overlay_entropy": 8.0, "avg_basic_blocks": 11.69, "avg_section_size": 358058.66, "dependency_count": 15.0, "entropy_variance": 1.11, "avg_string_length": 18.79, "complexity_per_kb": 0.0, "max_string_length": 560.0, "wide_string_count": 195.0, "writable_sections": 1.0, "avg_string_entropy": 2.91, "code_to_data_ratio": 3.43, "data_to_file_ratio": 0.01, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.26, "total_basic_blocks": 1473.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "high_entropy_strings": 3.0, "string_length_stddev": 24.09, "debug_reference_count": 1.0, "high_complexity_funcs": 2.0, "largest_section_ratio": 0.26, "sentence_string_count": 553.0, "sentence_string_ratio": 0.13, "behavioral_import_ratio": 0.07, "unnamed_complex_func_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 544, ".text" ], [ 623, "@.data" ], [ 664, ".pdata" ], [ 703, "@.rsrc" ], [ 743, "@.reloc" ], [ 17322, "VWAVH" ], [ 19289, "H9D9" ], [ 42931, "L1HH" ], [ 42971, "D0PH" ], [ 43070, "D1HD" ], [ 43076, "L1XI" ], [ 43433, "L9HH" ], [ 43957, "UVWATAUAVAWH" ], [ 50905, "SVWATAUAVAWH" ], [ 58128, "@USVWATAVAWH" ], [ 60243, "USVWATAUAVAWH" ], [ 62668, "L9IHA" ], [ 66760, "L1HE" ], [ 70245, "UVAVH" ], [ 71362, "D1HF" ], [ 81517, "gfffffffH" ], [ 88317, "gfffffffI" ], [ 91823, "/u\tH" ], [ 99596, "t$ WATAUAVAWH" ], [ 102668, "|$ UATAUAVAWH" ], [ 110465, "/uQI" ], [ 110487, "/tEH" ], [ 112970, "L9AHA" ], [ 114265, "k VWAVH" ], [ 117866, "UVWH" ], [ 121762, "/u\tI" ], [ 121916, "/t\tH" ], [ 133429, "UWAVH" ], [ 142533, "SAUH" ], [ 148042, "C E3" ], [ 150821, "SUVWATAUAVAWH" ], [ 154013, "x UATAUAVAWH" ], [ 161872, "@USVWATAUAVAWH" ], [ 187268, "M7H3" ], [ 192594, "MXH3" ], [ 207206, "IHDRE" ], [ 207486, "F%IDATA3" ], [ 207725, "IEND5" ], [ 207838, "SUVWAUH" ], [ 208443, "6A9F" ], [ 212612, "vb'vb'v" ], [ 234007, "t$ UWATAVAWH" ], [ 249511, "SUVWAVH" ], [ 254921, "s WATAUAVAWH" ], [ 273085, "CXE3" ], [ 276086, "L9PH" ], [ 286608, "@SVWATAUAVAWH" ], [ 311987, "M H3" ], [ 313764, "D$ H)D$(" ], [ 328185, "p UATAUAVAWH" ], [ 331649, "/Kim" ], [ 336564, "U8E3" ], [ 337602, "\\$ UVWATAUAVAWH" ], [ 340387, "USVWAVI" ], [ 361474, "\\$ VWATAUAWH" ], [ 365616, "@SUVWAUAVAWH" ], [ 366304, "@SUVWATAVAWH" ], [ 371456, "@USWATAUAVAWH" ], [ 372576, "@SUWATAUAWH" ], [ 377936, "@UWATAUAVAWH" ], [ 379280, "@UVWATAUAWH" ], [ 395557, "SVATH" ], [ 404441, "k VWATAVAWH" ], [ 410949, "SUWAWH" ], [ 411110, "H9D1" ], [ 437031, "l$ VWATAVAWH" ], [ 437889, "B8E3" ], [ 438536, "LV0H" ], [ 439806, "LN0H" ], [ 447473, "J9D3" ], [ 466641, "MPH3" ], [ 479959, "l$ VWAUAVAWH" ], [ 483137, "EHE3" ], [ 484109, "E8E3" ], [ 491232, "@USVATAUAWH" ], [ 492099, "WAUH" ], [ 523493, "MGH3" ], [ 531424, "@SATAUAVAWH" ], [ 550502, "p WATAUAVAWH" ], [ 559970, "\\$ UWATAUAVH" ], [ 571826, "L$ SVWATAVAWH" ], [ 574608, "@SUVWATAUAVAWH" ], [ 588889, "H9XH" ], [ 590954, "VWAWH" ], [ 597549, "p WAVAWH" ], [ 637554, "M0H3" ], [ 644418, "\\$ UATAUAVAWH" ], [ 686332, "L$ UWATAVAWH" ], [ 687431, "L$ UVWAVAWH" ], [ 716221, "H D8" ], [ 740092, "P I3" ], [ 747858, "\\$ UVWAUAWH" ], [ 755091, "VATH" ], [ 758306, "L$ SUVWATAVAWH" ], [ 767354, "SVWATH" ], [ 774272, "H3E H" ], [ 797570, "MHH3" ], [ 797735, "null" ], [ 798388, "UHE3" ], [ 802256, "MOH3" ], [ 808491, "H3C H" ], [ 810843, "EPE3" ], [ 812357, "X UVWATAUAVAWH" ], [ 847013, "SUWAVH" ], [ 849717, "UWAWH" ], [ 854642, "\\$ UWAUAVAWH" ], [ 880898, "\\$ UVWAVAWH" ], [ 897217, "O H9H" ], [ 899075, "VAVH" ], [ 901085, "EGE3" ], [ 923234, "D$ H)\\$(" ], [ 935431, "C8D8" ], [ 937691, "EH9C0" ], [ 957497, "s UWAUAVAWI" ], [ 958226, "\\$ UVWATAUH" ], [ 963090, "\\$ UVWAUAVH" ], [ 970146, "\\$ UVWATAVH" ], [ 1000283, "SWAVH" ], [ 1049857, "M8H3" ], [ 1103575, "t.HcK0H" ], [ 1106736, "@SUVWATAUAVH" ], [ 1148842, "SVWAWH" ], [ 1167483, "SVWAVH" ], [ 1172608, "gfffffffL" ], [ 1215476, "sH9.tgH" ], [ 1215882, "t89o" ], [ 1222896, "A8H9" ], [ 1226451, "A8L9" ], [ 1274932, "M7E3" ], [ 1277998, "H95S" ], [ 1284192, "CXD9" ], [ 1304425, "x ATAVAWH" ], [ 1304975, "l$ VWATAUAWH" ], [ 1324328, "GE88" ], [ 1324692, "GEX8" ], [ 1327392, "L95IL" ], [ 1327946, "L957J" ], [ 1335301, "{ ATAVAWH" ], [ 1341420, "@USVWAUAVAWH" ], [ 1344737, "Genu" ], [ 1361963, "IH9B" ], [ 1370769, "x AUAVAWH" ], [ 1373785, "x UAVAWH" ], [ 1383474, "N0E3" ], [ 1386207, "L$ UVWATAUAVAWH" ], [ 1388200, "E0E3" ], [ 1400879, "MHE2" ], [ 1417421, "A0E3" ], [ 1426370, "VWAV" ], [ 1431325, "s WAVAWH" ], [ 1436221, "SUWATAUAVAWH" ], [ 1440847, "t$ UWAUAVAWH" ], [ 1445420, "MPH9" ], [ 1448203, "UPH9" ], [ 1448616, "@UVWATAUAVAWH" ], [ 1471361, "{ AUAVAWH" ], [ 1476322, "\\$ VWATAUAVH" ], [ 1485631, "USVWAVH" ], [ 1491679, "H 9Y" ], [ 1499188, "@UATAUAVAWH" ], [ 1502388, "@USVWATAUAVH" ], [ 1506591, "f90t" ], [ 1515626, "VWAUH" ], [ 1544513, "L$ WATAUAVAWH" ], [ 1549426, "\\$ UWATAVAWH" ], [ 1556532, "F E3" ], [ 1563029, "SVWH" ], [ 1565947, "UUUUUUUUI" ], [ 1566161, "UUUUUUUUH" ], [ 1567909, "SUVWH" ], [ 1573721, "SWAWH" ], [ 1580227, "USVAVH" ], [ 1581587, "WAWH" ], [ 1585191, "WATH" ], [ 1586199, "L$ UVWATAWH" ], [ 1602579, "UVAWI" ], [ 1615074, "G L9" ], [ 1615099, "E L9" ], [ 1626128, "ob0f" ], [ 1627377, "vKfffff" ], [ 1636805, "SUWH" ], [ 1639043, "H9AH" ], [ 1640508, "L9BHA" ], [ 1668223, "AdminPackets\"\u003c" ], [ 1668239, "AdminRegistrationPacket" ], [ 1668266, "username" ], [ 1668284, "version" ], [ 1668301, "AdminRequestFileListPacket" ], [ 1668331, "location" ], [ 1668349, "AdminRequestFilePacket" ], [ 1668393, "AdminStealerPacket" ], [ 1668415, "steal_string" ], [ 1668437, "AdminCreateFilePacket" ], [ 1668480, "AdminCreateDirPacket" ], [ 1668522, "AdminDeleteFilePacket" ], [ 1668565, "AdminEditFilePacket" ], [ 1668588, "new_data" ], [ 1668624, "AdminUploadFilePacket" ], [ 1668666, "file_data" ], [ 1668686, "AdminRenameFilePacket" ], [ 1668711, "new_name" ], [ 1668747, "AdminReturnFileListPacket" ], [ 1668793, "!AdminStartScreenTranslationPacket" ], [ 1668830, "screen_id" ], [ 1668849, "!AdminStartCameraTranslationPacket" ], [ 1668886, "camera_id" ], [ 1668905, "%AdminStartMicrophoneTranslationPacket" ], [ 1668947, "microphone_id" ], [ 1668969, "$AdminContinueScreenTranslationPacket" ], [ 1669028, "$AdminContinueCameraTranslationPacket" ], [ 1669087, "(AdminContinueMicrophoneTranslationPacket" ], [ 1669154, "AdminStopScreenTranslationPacket" ], [ 1669209, "AdminStopCameraTranslationPacket" ], [ 1669264, "$AdminStopMicrophoneTranslationPacket" ], [ 1669328, "AdminMouseEventPacket" ], [ 1669352, "button_id" ], [ 1669387, "monitor_id" ], [ 1669429, "AdminKeyboardEventPacket" ], [ 1669491, "AdminRotateScreenPacket" ], [ 1669518, "mode_id" ], [ 1669535, "AdminExecuteCommandPacket" ], [ 1669579, "command" ], [ 1669596, "AdminGetResourceMonitorPacket\"" ], [ 1669629, "AdminGetTaskManagerPacket\"" ], [ 1669658, "AdminUninstallClientPacket\"" ], [ 1669688, "AdminDisconnectClientPacket\"" ], [ 1669719, "AdminRestartClientPacket\"-" ], [ 1669747, "AdminUpdateClientPacket" ], [ 1669774, "new_client" ], [ 1669794, "sky.nnst.Connection.PacketsB" ], [ 1669823, "AdminPacketsb" ], [ 1669837, "proto3" ], [ 1670960, "admin.proto" ], [ 1672152, "Unknown exception" ], [ 1672224, "bad array new length" ], [ 1672248, "string too long" ], [ 1672312, "AdminPackets.AdminRegistrationPacket.username" ], [ 1672360, "AdminPackets.AdminRegistrationPacket.version" ], [ 1672408, "AdminPackets.AdminRequestFileListPacket.location" ], [ 1672464, "AdminPackets.AdminRequestFilePacket.location" ], [ 1672512, "AdminPackets.AdminStealerPacket.steal_string" ], [ 1672560, "AdminPackets.AdminCreateFilePacket.location" ], [ 1672608, "AdminPackets.AdminCreateDirPacket.location" ], [ 1672656, "AdminPackets.AdminDeleteFilePacket.location" ], [ 1672704, "AdminPackets.AdminEditFilePacket.new_data" ], [ 1672752, "AdminPackets.AdminEditFilePacket.location" ], [ 1672800, "AdminPackets.AdminUploadFilePacket.location" ], [ 1672848, "AdminPackets.AdminRenameFilePacket.new_name" ], [ 1672896, "AdminPackets.AdminRenameFilePacket.location" ], [ 1672944, "AdminPackets.AdminReturnFileListPacket.location" ] ], "sz": 6297248, "ts": [ { "a": "T1562.001", "c": 0.9800000190734863, "d": "Embedded Defender exclusion cmdlet", "e": [ "Add-MpPreference -ExclusionPath" ], "i": "objectives/evasion/anti-av/platform::defender-exclusion-cmdlet", "l": 4 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "IDEMPOTENT", "UVWATAUAVAWH", "UNVERIFIEDB", "EXPANDED", "SUWATAUAVAWH", "SVWATAUAVAWH", "UUUUUUUUI", "UUUUUUUUH", "UNVERIFIED", "EXPLICIT", "DECLARATION", "DELIMITED", "IMPLICIT" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with many wide strings", "e": [ "binary.wide_string_count = 195.00" ], "i": "objectives/anti-static/obfuscation/payload/section::heavy-wide-string-corpus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Direct PEB access (GS segment)", "e": [ "65 48 8b 04 25 60 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-access-x64", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "absl::string_view::substr", "invalid string position", "GetRepeatedString", "\\StringFileInfo\\040904b0\\FileDescription", "GetStringView", "SetString", "CPPTYPE_STRING", "steal_string", "AddString", "AdminPackets.AdminStealerPacket.steal_string", "string too long", "StringFileInfo", "GetStringReference", "GetRepeatedStringReference", "String field", "GetString" ], "i": "micro-behaviors/communications/http/client::webclient--rx-7", "l": 1 }, { "a": "T1497.003", "c": 0.699999988079071, "d": "QueryPerformanceFrequency timing", "e": [ "QueryPerformanceFrequency" ], "i": "micro-behaviors/time/timing/check::query-performance-frequency", "l": 2, "m": "B0003.003" }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 224.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "a": "T1046", "c": 0.6000000238418579, "d": "Kerberos port 88", "e": [ "88" ], "i": "objectives/discovery/network/scan::kerberos-port", "l": 1, "m": "E1046" }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 23 (socket)", "e": [ "ORDINAL 23" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-23", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "a": "T1083", "c": 0.8799999952316284, "d": "Enumerate logical drive letters", "e": [ "GetLogicalDrives" ], "i": "micro-behaviors/fs/traversal/drives::get-logical-drives-text", "l": 3, "m": "E1083" }, { "a": "T1567.002", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "C:\\Users\\decel\\vcpkg\\buildtrees\\abseil\\src\\20250127.1-a0a219bf72.clean\\absl\\synchronization\\mutex.cc", ".?AU?$_PPLTaskHandle@EU?$_InitialTaskHandle@XV\u003clambda_d31b5e694f3e1110c912bfa8c980bbb0\u003e@@U_TypeSelectorNoAsync@details@Concurren", ".?AV?$_Deferred_async_state@X@std@@", ".?AU?$_InitialTaskHandle@XV\u003clambda_b0b2c08bd8b809ec0ff6cb052c5e2e40\u003e@@U_TypeSelectorNoAsync@details@Concurrency@@@?$task@E@Concu", ".?AV?$_Task_async_state@X@std@@", "C:\\Users\\decel\\vcpkg\\buildtrees\\abseil\\src\\20250127.1-a0a219bf72.clean\\absl\\synchronization\\internal\\win32_waiter.cc", "api-ms-win-core-synch-l1-2-0", ".?AU?$_PPLTaskHandle@EU?$_InitialTaskHandle@XV\u003clambda_b0b2c08bd8b809ec0ff6cb052c5e2e40\u003e@@U_TypeSelectorNoAsync@details@Concurren", ".?AU?$_InitialTaskHandle@XV\u003clambda_d31b5e694f3e1110c912bfa8c980bbb0\u003e@@U_TypeSelectorNoAsync@details@Concurrency@@@?$task@E@Concu" ], "i": "well-known/tool/dual-use/megacmd::megacmd-binary-name--rx-5", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "PE built after 2020-01-01", "e": [ "pe.timestamp = 1763903378.00" ], "i": "metadata/hardening::post-2020-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":false}" ], "i": "metadata/build::pe-has-manifest", "l": 2 }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".tmp" ], "i": "objectives/impact/infect/binary::tmp-extension-staging", "l": 1 }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE TLS callback table present", "e": [ "pe.tls_callbacks = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-callbacks-metric", "l": 1 }, { "c": 0.6000000238418579, "d": "System32 substring reference", "e": [ "C:\\Windows\\System32\\cmd.exe" ], "i": "micro-behaviors/fs/path/system::system32-substr", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "d": "POSIX \"Permission denied\" error message", "e": [ "Permission denied" ], "i": "micro-behaviors/os/message/error::permission-denied", "l": 2 }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1083", "c": 0.6600000262260437, "d": "C:\\\\Windows\\\\System32\\\\ directory path", "e": [ "C:\\Windows\\System32\\" ], "i": "micro-behaviors/fs/path/system::windows-system32", "l": 3, "m": "E1083" }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 224.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceExA" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".pdata", ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.func_count = 6422.00" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute-cond-4--inline-11988", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "virussign.com_75055681acee4098daf34250c61c75e0.vir" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "a": "T1070.004", "c": 0.9200000166893005, "d": "Batch with timeout before deletion", "e": [ "timeout /t 1 \u003enul \u0026 del" ], "i": "objectives/evasion/self-delete/file::batch-timeout-delete", "l": 4, "m": "F0007" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "GetTempPathA", "powershell -Command \"Add-MpPreference -ExclusionPath $env:APPDATA\"", "GetFullPathNameW", "GetFullPathNameA", "GetTempPath2W", "GetTempPathW", "SHGetFolderPathA" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "a": "T1129", "c": 0.6499999761581421, "d": "SRW lock acquisition", "e": [ "AcquireSRWLockExclusive" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-acquire", "l": 2 }, { "c": 0.800000011920929, "d": "Create a named file-mapping object (wide)", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w", "l": 2 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 4147872.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 3 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "Connection lost - invalid packet length", "Connection closed by remote host during send", "Connection lost - failed to send packet length", "WinHttpConnect", "Connection lost - failed to parse packet", "Connection lost - failed to send packet data", "Connection lost - failed to read packet length", "sky.nnst.Connection.PacketsB", "Connection closed by remote host during receive", "Connection lost - failed to read packet data" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012" }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1 }, { "c": 0.6000000238418579, "d": "payload keyword", "e": [ "payload" ], "i": "micro-behaviors/data/text/keywords::payload", "l": 1 }, { "c": 0.949999988079071, "d": "Enumerate resource names (callback trigger)", "e": [ "EnumResourceNamesW" ], "i": "micro-behaviors/os/callback/enum::enum-resource-names", "l": 3 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug directory timestamp is 2025 or newer", "e": [ "pe.debug_timestamp_min = 1763903378.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamp-post-2024", "l": 1 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "a": "T1102", "c": 0.7200000286102295, "d": "EVM function selector literal", "e": [ "0xf92b8ea4", "0x77eda076", "0x98e5644d", "0x6e02efe5" ], "i": "objectives/command-and-control/infrastructure/blockchain/polygon::evm-selector-hex-literal", "l": 1 }, { "a": "T1083", "c": 0.6600000262260437, "d": "C:\\\\Windows\\\\ directory path", "e": [ "C:\\Windows\\System32\\cmd" ], "i": "micro-behaviors/fs/path/system::windows-root", "l": 2, "m": "E1083" }, { "a": "T1016", "c": 0.8999999761581421, "d": "Enumerate local network adapter addresses", "e": [ "GetAdaptersAddresses" ], "i": "micro-behaviors/os/network/interface::get-adapters-addresses", "l": 3 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 4 (connect)", "e": [ "ORDINAL 4" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-4", "l": 1 }, { "a": "T1204.002", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "Create and manage peers, extern WINAPI, using for checking system updates, read and write data to all Win-Sockets.", "ADMIN_CREATE_FILE", "D3D11CreateDevice", "ADMIN_CREATE_DIR", "AdminPackets.AdminCreateFilePacket.location", "MFCreateMediaType", "AdminCreateFilePacket", "AdminPackets.AdminCreateDirPacket.location", "Could not create an instance of", "AdminCreateDirPacket", "MFCreateAttributes", "create_directories", "CoCreateInstance", "MFCreateSourceReaderFromMediaSource", "schtasks /Create /TN \"PeerCreator\" /TR \"", "CreateProcessW" ], "i": "objectives/command-and-control/dropper/execution/clickfix::schtasks-remote-unc-xml--rx-3", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection::enum-locale-callback", "l": 3, "m": "E1106" }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "a": "T1486", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "Files with optimize_for = LITE_RUNTIME cannot define services unless you set both options cc_generic_services and java_generic_s", "py_generic_services", "php_generic_services\"", "cc_generic_services", "java_generic_services" ], "i": "objectives/impact/ransom/encrypt/hybrid::rust-ransomware-module-set--rx-3", "l": 1, "m": "B0040" }, { "d": "Stream string fragment", "e": [ "google.protobuf.StreamOptions" ], "i": "objectives/execution/interpreter/script/wsh-fragments::adodb-fragment-stream-dup", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening::pe-dep", "l": 2 }, { "c": 0.8500000238418579, "d": "Modify file metadata attributes", "e": [ "SetFileInformationByHandle" ], "i": "micro-behaviors/fs/file/handle::set-file-information-by-handle", "l": 2 }, { "a": "T1016", "c": 0.8500000238418579, "d": "ipify.org external IP lookup", "e": [ "ipify.org" ], "i": "micro-behaviors/data/text/ip::ipify-org", "l": 3, "m": "C0002" }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 224.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8500000238418579, "d": "Locale-aware string mapping", "e": [ "LCMapStringEx" ], "i": "micro-behaviors/os/env/access::lcmap-string-ex", "l": 2 }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft company string", "e": [ "© Microsoft Corporation. All rights reserved." ], "i": "objectives/evasion/masquerade/dll/task-scheduler::microsoft-company-string", "l": 1 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build::pe-as-invoker", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "virussign.com_75055681acee4098daf34250c61c75e0.vir" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-localization-l1-2-1" ], "i": "metadata/binary/linking::api-set-core-cluster", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 115 (WSAStartup)", "e": [ "ORDINAL 115" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-115", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 6422.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 224.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 224.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "f-\u003eheader.magic == Magic(kMagicAllocated, \u0026f-\u003eheader)", "bad magic number in Next()", "next-\u003eheader.magic == Magic(kMagicUnallocated, \u0026next-\u003eheader)", "bad magic number in AddToFreelist()" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-7", "l": 1, "m": "C0027" }, { "c": 0.9800000190734863, "d": "Regex component marker", "e": [ "binary.func_count = 6422.00" ], "i": "micro-behaviors/process/terminate/kill::toolhelp-kill-loop-source-cond-6--inline-3846", "l": 1 }, { "d": "COMPUTERNAME environment variable", "e": [ "GetComputerNameA" ], "i": "micro-behaviors/os/env/vars/system-info::computername-var", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 224.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Locate PE resource entry with language", "e": [ "FindResourceExW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-ex-w", "l": 2 }, { "a": "T1547.001", "c": 0.699999988079071, "d": "schtasks /create command", "e": [ "schtasks /Create" ], "i": "objectives/persistence/login/scheduled-task::schtasks-create-cmd", "l": 4 }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "0c 00 50 15", "09 00 30 12", "09 00 20 14", "08 00 b0 4b", "0b 00 50 01", "0c 00 70 c3", "08 00 50 4d", "08 00 7c ac", "0a 00 f0 24", "06 00 b0 fa", "06 00 10 55", "08 00 00 4b", "06 00 50 fa", "06 00 70 d2", "07 00 30 ab", "06 00 d0 53" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003c/assembly\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.6600000262260437, "d": "Copy files (Windows API ANSI)", "e": [ "CopyFileA" ], "i": "micro-behaviors/fs/file/copy::copyfile-a", "l": 3 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "Close WinHTTP handle object", "e": [ "WinHttpCloseHandle" ], "i": "micro-behaviors/communications/http/client::winhttp-close-handle", "l": 3, "m": "C0002" }, { "c": 0.8199999928474426, "d": "Set COM proxy security", "e": [ "CoSetProxyBlanket" ], "i": "micro-behaviors/os/com/invoke::co-set-proxy-blanket", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 1.0, "d": "Binary has 5000+ functions", "e": [ "binary.func_count = 6422.00" ], "i": "metadata/binary/metrics::many-functions-5000", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "ClientPackets.ClientReturnCommandLineOutputPacket.command_line_id", "ClientPackets.ClientReturnCommandLineOutputPacketcommand_line_idoutput", "command_line_id", "command", "AdminPackets.AdminExecuteCommandPacketcl_idcommand", "AdminPackets.AdminExecuteCommandPacket.command" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 2560.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1106", "c": 0.8500000238418579, "d": "CreateProcessW API string", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w-string", "l": 3 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Send WinHTTP request to server", "e": [ "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client::winhttp-send-request", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 1.0, "d": "PGO-trained release build (POGO)", "e": [ "true" ], "i": "metadata/build/reproducible::pe-pgo-trained", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\io\\zero_copy_stream.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\extension_set.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/descriptor.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/extension_set_inl.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/reflection_internal.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\wire_format.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\message.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\message_lite.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\generated_message_reflection.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\wire_format_lite.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/parse_context.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\generated_message_tctable_lite.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\io\\zero_copy_stream_impl_lite.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\io\\coded_stream.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\arena.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/map_field.h" ], "i": "objectives/evasion/masquerade/file/suspicious-path::exe-in-media-folder--rx-8", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "a": "T1129", "c": 0.6499999761581421, "d": "Condition variable signal", "e": [ "WakeAllConditionVariable", "WakeConditionVariable" ], "i": "micro-behaviors/process/threading/advanced-sync::condition-variable-signal", "l": 2 }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 6422.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8500000238418579, "d": "api.ipify.org IP lookup", "e": [ "api.ipify.org" ], "i": "objectives/discovery/network/scan::ipify-org", "l": 3 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Read WinHTTP response body", "e": [ "WinHttpReadData" ], "i": "micro-behaviors/communications/http/client::winhttp-read-data", "l": 3, "m": "C0002" }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "Configure WinHTTP timeout values", "e": [ "WinHttpSetTimeouts" ], "i": "micro-behaviors/communications/http/client::winhttp-set-timeouts", "l": 3, "m": "C0002" }, { "a": "T1112", "c": 0.6499999761581421, "d": "Windows runas verb token", "e": [ "runas" ], "i": "objectives/impact/degrade/system::runas-verb-token", "l": 1 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "spanish-dominican republic", "Invalid public dependency index.", "public_dependency" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\io\\zero_copy_stream_impl_lite.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\message.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\wire_format_lite.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\generated_message_tctable_lite.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/extension_set_inl.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\wire_format.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/descriptor.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\extension_set.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\message_lite.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\io\\zero_copy_stream.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\arena.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\io\\coded_stream.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/map_field.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\generated_message_reflection.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/parse_context.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/reflection_internal.h" ], "i": "objectives/evasion/process::exe-in-media-folder--rx-8", "l": 1 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Enumerate logical drive letters", "e": [ "GetLogicalDrives" ], "i": "micro-behaviors/fs/traversal/drives::get-logical-drives", "l": 3, "m": "E1083" }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 224.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "a": "T1082,T1041", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "for /l %i in () do (tasklist | find /i \"PeerService.exe\" \u003enul || (copy /y \"" ], "i": "objectives/exfiltration/stealer/system-info::windows-recon-output-file--rx-2", "l": 1 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Receive WinHTTP server response", "e": [ "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client::winhttp-receive-response", "l": 3, "m": "C0002" }, { "a": "T1140", "c": 0.8999999761581421, "d": "Microsoft company string", "e": [ "© Microsoft Corporation. All rights reserved." ], "i": "objectives/command-and-control/dropper/staging::microsoft-company-string", "l": 1, "m": "B0023" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload::lock-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8500000238418579, "d": "WMI computer system class query", "e": [ "Win32_ComputerSystemProduct" ], "i": "objectives/anti-analysis/vm-detect/wmi::computer-system-query", "l": 1, "m": "B0009" }, { "c": 0.8500000238418579, "d": "XOR byte then zero-extend", "e": [ "fe c2", "f8 19" ], "i": "micro-behaviors/crypto/symmetric/xor::x64-xor-imm8-widen-loop", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 4135.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "virussign.com_75055681acee4098daf34250c61c75e0.vir" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 4135.00" ], "i": "metadata/binary/metrics::many-strings-2000", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.800000011920929, "d": "Commit PE resource modifications", "e": [ "EndUpdateResourceW" ], "i": "micro-behaviors/data/embedded/payload::end-update-resource-w", "l": 3 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1473.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "d": "overflow keyword", "e": [ "size_t overflow", "Hash table size overflow", "std::string size overflow", "escaped_len overflow", "LowLevelAlloc arithmetic overflow" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query computer/host name", "e": [ "GetComputerNameA" ], "i": "micro-behaviors/os/sysinfo/hostname::get-computer-name", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "Too many links", "too many links" ], "i": "objectives/evasion/process::exe-in-media-folder--rx-6", "l": 1 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::get-user-default-lcid", "l": 2 }, { "a": "T1129", "c": 0.6499999761581421, "d": "SRW lock release", "e": [ "ReleaseSRWLockExclusive" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-release", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "true" ], "i": "metadata/hardening::pe-high-entropy-va", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 224.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceExA" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "SPEED" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-77", "l": 1 }, { "a": "T1129", "c": 0.6499999761581421, "d": "Condition variable wait", "e": [ "SleepConditionVariableSRW" ], "i": "micro-behaviors/process/threading/advanced-sync::condition-variable-wait", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Connect WinHTTP to remote host", "e": [ "WinHttpConnect" ], "i": "micro-behaviors/communications/http/client::winhttp-connect", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/handle::get-console-output-cp", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.8500000238418579, "d": "WMI processor class query", "e": [ "Win32_Processor" ], "i": "objectives/anti-analysis/vm-detect/wmi::processor-query", "l": 1, "m": "B0009" }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "payload" ], "i": "objectives/command-and-control/dropper/staging::staged-payload-file-name--rx-1", "l": 1, "m": "B0023" }, { "a": "T1112", "c": 0.8999999761581421, "d": "GetComputerName API", "e": [ "GetComputerNameA" ], "i": "objectives/anti-static/obfuscation/payload::get-computer-name", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1547.001", "c": 0.7799999713897705, "d": "Scheduled task highest runlevel", "e": [ "/RL HIGHEST" ], "i": "objectives/persistence/login/scheduled-task::schtasks-runlevel-highest", "l": 4 }, { "c": 0.550000011920929, "d": "Stdout redirected to NUL", "e": [ "\u003enul" ], "i": "micro-behaviors/os/console/io::windows-stdout-to-nul", "l": 2 }, { "c": 0.8399999737739563, "d": "Initialize COM security context", "e": [ "CoInitializeSecurity" ], "i": "micro-behaviors/os/com/invoke::co-initialize-security", "l": 3 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 6422.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "ClientPackets.ClientReturnCommandLineOutputPacket.output", "output", "output_type", "output-\u003emessage_info.prototype != nullptr", "google.protobuf.MethodDescriptorProtonameinput_typeoutput_type", "Input/output error", "Failed to get monitor output", "ClientPackets.ClientReturnCommandLineOutputPacketcommand_line_idoutput" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA", "CreateProcessW" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system memory capacity", "e": [ "GlobalMemoryStatusEx" ], "i": "micro-behaviors/os/sysinfo/hardware::get-memory-status", "l": 2 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Create WinHTTP HTTP request handle", "e": [ "WinHttpOpenRequest" ], "i": "micro-behaviors/communications/http/client::winhttp-open-request", "l": 3, "m": "C0002" }, { "c": 0.8500000238418579, "d": "runas elevation verb", "e": [ "runas" ], "i": "objectives/privilege-escalation/token-manipulation::runas-word", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.91" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.overlay_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080", "l": 1 }, { "c": 0.699999988079071, "d": "Version information string", "e": [ "v1.0" ], "i": "metadata/package/help::version-text", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "a": "T1059.001", "c": 0.8999999761581421, "d": "PowerShell launcher reference", "e": [ "powershell" ], "i": "objectives/execution/interpreter/script/wsh::powershell-launcher", "l": 1 }, { "c": 0.949999988079071, "d": "Regex component marker", "e": [ "\" must have a leading dot to indicate the fully-qualified scope.", "google.protobuf.ExtensionRangeOptions.Declarationfull_nametype", "full_name", "should have both \"full_name\" and \"type\" set." ], "i": "micro-behaviors/mem/read::comsvcs-dump--rx-4", "l": 1 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Resolve symbol from address (imagehlp)", "e": [ "SymFromAddr" ], "i": "micro-behaviors/process/debug/symbol::sym-from-addr", "l": 3 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 224.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "a": "T1071", "c": 0.7799999713897705, "d": "Winsock library string marker", "e": [ "WS2_32.dll" ], "i": "objectives/command-and-control/backdoor/binary::winsock-library-reference", "l": 1 }, { "c": 0.9599999785423279, "d": "Overlay size at least 1 MiB", "e": [ "binary.overlay_size = 4147872.00" ], "i": "metadata/binary/layout::large-overlay-1mb", "l": 3 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 16 (recv)", "e": [ "ORDINAL 16" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-16", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Initialize WinHTTP session", "e": [ "WinHttpOpen" ], "i": "micro-behaviors/communications/http/client::winhttp-open", "l": 3, "m": "C0002" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "min_bytes \u003c= std::numeric_limits\u003csize_t\u003e::max() - SerialArena::kBlockHeaderSize" ], "i": "micro-behaviors/communications/http/client::webclient--rx-6", "l": 1 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "not connected", "already connected" ], "i": "micro-behaviors/communications/http/llm::gpt-proxy-websocket-upstream--rx-13", "l": 1 }, { "c": 0.9599999785423279, "d": "PE overlay exceeds 1 MiB", "e": [ "binary.overlay_size = 4147872.00" ], "i": "metadata/binary/layout::overlay-over-1mb", "l": 3 }, { "c": 0.699999988079071, "d": "runas privilege elevation string", "e": [ "runas" ], "i": "micro-behaviors/os/privilege/elevation::runas-string", "l": 3 }, { "a": "T1053.005", "c": 0.75, "d": "Task triggers on user logon", "e": [ "ONLOGON" ], "i": "objectives/persistence/login/scheduled-task/masquerade::logon-trigger", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "reg add Run", "e": [ "reg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ], "i": "objectives/persistence/login/registry/autostart::reg-add-run", "l": 3 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "a": "T1657", "c": 0.699999988079071, "d": "D3D11CreateDevice API", "e": [ "D3D11CreateDevice" ], "i": "micro-behaviors/hardware/display/directx/calls::directx-device-d3d11", "l": 2 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.76" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\" /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.8500000238418579, "d": "ipify.org IP discovery API", "e": [ "api.ipify.org" ], "i": "micro-behaviors/communications/http/ip-discovery::ipify-api", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "virussign.com_75055681acee4098daf34250c61c75e0.vir" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "a": "T1559", "c": 0.8999999761581421, "d": "Create anonymous pipe", "e": [ "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::create-pipe", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "a": "T1547.001", "c": 0.6000000238418579, "d": "HKCU Run key reference", "e": [ "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ], "i": "objectives/persistence/login/startup/registry::hkcu-run", "l": 3 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "too many links", "Too many links" ], "i": "objectives/evasion/masquerade/file/suspicious-path::exe-in-media-folder--rx-6", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening::pe-aslr", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "Native runtime has many functions", "e": [ "binary.func_count = 6422.00" ], "i": "metadata/lang/compiler/aot::huge-runtime-function-count", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 224.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::load-resource", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 3 }, { "d": "password keyword", "e": [ "PasswordWaitingPacket\"", "ClientPackets.PasswordPacketpassword", ".?AVPasswordWaitingPacket@ServerPackets@@", "SERVER_PASSWORD_WAITING", "PasswordPacket", ".?AVPasswordPacket@ClientPackets@@", "CLIENT_PASSWORD", "ClientPackets.PasswordPacket.password", "password" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder path via Shell32 ANSI", "e": [ "SHGetFolderPathA" ], "i": "micro-behaviors/fs/shell-ops::shell-get-folder-path-a", "l": 2 }, { "a": "T1204.002", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "schtasks /Create /TN \"PeerCreator\" /TR \"", "schtasks /Query /TN \"PeerCreator\"" ], "i": "objectives/command-and-control/dropper/execution/clickfix::schtasks-remote-unc-xml--rx-2", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-dialogbox-l1-1-0", "ext-ms-win-ntuser-windowstation-l1-1-0" ], "i": "metadata/binary/linking::api-set-ext-cluster", "l": 2 }, { "a": "T1070.004", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "Note that enum values use C++ scoping rules, meaning that enum values are siblings of their type, not children of it. Therefore", ".?AVFastFieldValuePrinterUtf8Escaping@Printer@TextFormat@protobuf@google@@", "Invalid escaping in default value.", "CreateFileMappingW", "C:\\Users\\decel\\vcpkg\\buildtrees\\abseil\\src\\20250127.1-a0a219bf72.clean\\absl\\strings\\escaping.cc" ], "i": "objectives/evasion/self-delete/file::ping-self-delete--rx-2", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::sizeof-resource", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringA" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "AdminUploadFilePacket", "AdminPackets.AdminUploadFilePacketlocation", ".?AVAdminUploadFilePacket@AdminPackets@@", "ADMIN_UPLOAD_FILE", "AdminPackets.AdminUploadFilePacket.location" ], "i": "micro-behaviors/communications/http/client::webclient--rx-8", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (Unicode)", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w", "l": 3 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.22" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 1.0, "d": "Modify PE resources via UpdateResourceW", "e": [ "UpdateResourceW" ], "i": "micro-behaviors/fs/file/write::update-resource-w", "l": 3 }, { "a": "T1567", "c": 1.0, "d": "Bulk common data path list (reconnaissance context)", "e": [ "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf" ], "i": "objectives/exfiltration/cloud/sync-tool::bulk-common-data-path", "l": 1 }, { "a": "T1567", "c": 1.0, "d": "Regex component marker", "e": [ "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\extension_set.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/parse_context.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\io\\zero_copy_stream_impl_lite.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\message.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/descriptor.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/map_field.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\message_lite.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\io\\zero_copy_stream.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\generated_message_tctable_lite.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/reflection_internal.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\wire_format.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\arena.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\generated_message_reflection.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google/protobuf/extension_set_inl.h", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\io\\coded_stream.cc", "C:\\Users\\decel\\vcpkg\\buildtrees\\protobuf\\src\\v5.29.3-7ac3e413eb.clean\\src\\google\\protobuf\\wire_format_lite.cc" ], "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 19 (send)", "e": [ "ORDINAL 19" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-19", "l": 1 }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\M" ], "i": "objectives/anti-static/obfuscation/payload::hkcu-software-text", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "a": "T1053.005", "c": 0.800000011920929, "d": "Scheduled task naming context", "e": [ "/TN " ], "i": "objectives/persistence/login/scheduled-task/masquerade::task-name-context", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Query drive type by symbol", "e": [ "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type", "l": 2 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "a": "T1027,T1112,T1059.001", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "powershell -Command \"Add-MpPreference -ExclusionPath $env:APPDATA\"" ], "i": "objectives/command-and-control/dropper/staging/embedded::registry-powershell-byte-payload--rx-5", "l": 1 }, { "c": 0.8500000238418579, "d": "File API ANSI check", "e": [ "AreFileApisANSI" ], "i": "micro-behaviors/os/env/access::are-file-apis-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8500000238418579, "d": "WMI video controller class query", "e": [ "Win32_VideoController" ], "i": "objectives/anti-analysis/vm-detect/wmi::video-controller-query", "l": 1, "m": "B0009" }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.66" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 3 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "a": "T1547.001", "c": 0.7799999713897705, "d": "Scheduled task ONLOGON trigger", "e": [ "/SC ONLOGON" ], "i": "objectives/persistence/login/scheduled-task::schtasks-onlogon-trigger", "l": 4 }, { "c": 0.8500000238418579, "d": "WMI baseboard class query", "e": [ "Win32_BaseBoard" ], "i": "objectives/anti-analysis/vm-detect/wmi::baseboard-query", "l": 1, "m": "B0009" }, { "c": 0.8999999761581421, "d": "Query timezone configuration", "e": [ "GetTimeZoneInformation" ], "i": "micro-behaviors/time/query::get-timezone-information", "l": 2 }, { "a": "T1547.001", "c": 0.800000011920929, "d": "HKCU Run registry key path", "e": [ "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ], "i": "objectives/persistence/login/registry/run-key::hkcu-run-key", "l": 4, "m": "F0012" }, { "c": 0.8999999761581421, "d": "RtlGenRandom export-ordinal alias (SystemFunction036)", "e": [ "SystemFunction036" ], "i": "micro-behaviors/os/random/generator::system-function-036", "l": 3 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.800000011920929, "d": "Initialize COM apartment model", "e": [ "CoInitializeEx" ], "i": "micro-behaviors/os/com/invoke::co-initialize-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".?AVClientKeepAlivePacket@ClientPackets@@", "ClientKeepAlivePacket\"," ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-5", "l": 1, "m": "F0004" }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteExW)", "e": [ "ShellExecuteExW" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex", "l": 3 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionEx", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "virussign.com_75055681acee4098daf34250c61c75e0.vir" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.45)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "d": "Windows directory path reference", "e": [ "C:\\Windows\\System32" ], "i": "micro-behaviors/fs/path/system::windows-dir", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW", "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "FindClose", "Connection closed by remote host during receive", "CloseThreadpoolWork", "legacy_closed_enum", "Connection closed by remote host during send", "CLOSED", "WinHttpCloseHandle", "CloseHandle", "The legacy closed enum behavior in C++ is deprecated and is scheduled to be removed in edition 2025. See http://protobuf.dev/pr" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 4135.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE has multiple TLS callbacks", "e": [ "pe.tls_callbacks = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-multi-callbacks", "l": 3 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "CreateFileMappingW API call", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w-import", "l": 1 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code TJ token", "e": [ "_TJ" ], "i": "objectives/anti-analysis/geofencing/region/country-code-c::country-code-tj", "l": 1, "m": "B0007.003" }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 1.0, "d": "String claiming to be Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/identity/vendor::microsoft-corporation-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.800000011920929, "d": "Query file attributes and timestamps", "e": [ "GetFileAttributesExW" ], "i": "micro-behaviors/fs/file/timestamp::get-file-attributes-ex", "l": 2 }, { "c": 0.8500000238418579, "d": "Execute commands via cmd.exe /c", "e": [ "cmd.exe /C \"" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-exe-c-command", "l": 3 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in read-only data", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rdata", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1057", "c": 0.8999999761581421, "d": "Get first process from snapshot", "e": [ "Process32FirstW" ], "i": "micro-behaviors/process/enumerate/snapshot::process32-first", "l": 3 }, { "a": "T1057", "c": 0.8999999761581421, "d": "Enumerate next process in snapshot", "e": [ "Process32NextW" ], "i": "micro-behaviors/process/enumerate/snapshot::process32-next", "l": 3 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 4135.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "ntdll.dll" ], "i": "objectives/evasion/anti-av/platform::ntdll-dll-str", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 6422.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.66" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Compatibility alias", "e": [ "GetAdaptersAddresses" ], "i": "micro-behaviors/os/sysinfo/network::get-adapters-addresses", "l": 1 }, { "a": "T1082", "c": 0.699999988079071, "d": "hwid string", "e": [ "HWID" ], "i": "objectives/discovery/system/fingerprint/machine-id::hwid-string", "l": 1 }, { "a": "T1033", "c": 0.8500000238418579, "d": "Check token group membership", "e": [ "CheckTokenMembership" ], "i": "micro-behaviors/os/privilege/check::check-token-membership", "l": 3 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "High entropy overlay data", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-entropy-overlay-raw", "l": 1, "m": "B0032" }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 4147872.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::medium-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Registry Run key", "e": [ "\\Run\"" ], "i": "objectives/persistence/login/registry/autostart::run-key", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.func_count = 6422.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Resource section entropy is unusually low", "e": [ "pe.rsrc_entropy = 3.35" ], "i": "objectives/anti-static/obfuscation/payload/section::low-entropy-rsrc", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "virussign.com_75055681acee4098daf34250c61c75e0.vir" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1057", "c": 0.6000000238418579, "d": "tasklist command (Windows)", "e": [ "tasklist" ], "i": "micro-behaviors/process/enumerate/shell::tasklist", "l": 3 }, { "c": 0.9700000286102295, "d": "Opens CurrentVersion Run key", "e": [ "reg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v PeerCreator /t REG_…" ], "i": "micro-behaviors/os/registry/access::currentversion-run-open-source", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 224.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.699999988079071, "d": "Large overlay relative to file", "e": [ "binary.overlay_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-overlay", "l": 2, "m": "B0032" }, { "a": "T1547.001", "c": 0.699999988079071, "d": "SOFTWARE CurrentVersion Run path", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ], "i": "objectives/persistence/login/startup/registry::software-run-key", "l": 3 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 4147872.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Abnormally low logic density for binary size", "e": [ "binary.complexity_per_kb = 0.00" ], "i": "objectives/anti-static/obfuscation/control-flow/logic::low-complexity-large-binary", "l": 2 }, { "a": "T1105", "c": 0.9599999785423279, "d": "Large overlay bundle component", "e": [ "binary.overlay_size = 4147872.00" ], "i": "objectives/command-and-control/dropper/execution/installer::large-overlay-bundle", "l": 1, "m": "B0022" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 3 }, { "a": "T1091", "c": 0.8799999952316284, "d": "Windows drive type query", "e": [ "GetDriveTypeW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-drive-type-w", "l": 1, "m": "B0017" }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.func_count = 6422.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1033", "c": 0.8999999761581421, "d": "Query current username", "e": [ "GetUserNameA" ], "i": "micro-behaviors/os/sysinfo/hostname::get-user-name", "l": 3 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1027.007", "c": 1.0, "d": "ntdll.dll as wide string (runtime resolver)", "e": [ "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::ntdll-wide-string", "l": 1, "m": "B0032.014" }, { "a": "T1033", "c": 0.8500000238418579, "d": "Allocate and initialize SID", "e": [ "AllocateAndInitializeSid" ], "i": "micro-behaviors/os/privilege/check::allocate-initialize-sid", "l": 3 }, { "c": 0.4000000059604645, "d": "XOR decryption loop byte pattern", "e": [ "00 41 39 2d 75", "66 41 fb 20 75", "66 41 fb 10 75", "01 48 ef 01 75" ], "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern", "l": 1 }, { "a": "T1027", "c": 0.20000000298023224, "d": "Hardcoded hex encoding charset (encoding/decoding)", "e": [ "0123456789ABCDEF0123456789abcdef", "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "objectives/anti-static/obfuscation/encoding::hardcoded-hex-charset", "l": 2, "m": "C0026" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "NtCurrentProcess handle (-1) for NT API call", "e": [ "48 C7 C1 FF FF FF FF" ], "i": "objectives/evasion/anti-av/syscall::nt-current-process-handle", "l": 1, "m": "F0004" }, { "a": "T1057", "c": 0.8999999761581421, "d": "Create process or module snapshot", "e": [ "CreateToolhelp32Snapshot" ], "i": "micro-behaviors/process/enumerate/snapshot::create-toolhelp32-snapshot", "l": 3, "m": "E1057" }, { "a": "T1547.001", "c": 0.75, "d": "Accesses Windows registry Run key", "e": [ "CurrentVersion\\Run" ], "i": "objectives/persistence/login/startup/registry::windows-registry-run-access", "l": 3 }, { "c": 0.699999988079071, "d": "WS2_32 Winsock DLL import", "e": [ "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "l": 3 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script::cmd-exe-dup", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.07" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AdminCreateDirPacket", "AdminRequestFileListPacket", "AdminContinueScreenTranslationPacket", "AdminCreateFilePacket", "AdminEditFilePacket", "AdminRequestFilePacket", "AdminStartMicrophoneTranslationPacket", "AdminReturnFileListPacket", "AdminStartScreenTranslationPacket", "AdminStartCameraTranslationPacket", "AdminDeleteFilePacket", "AdminStopScreenTranslationPacket", "AdminRenameFilePacket", "AdminUploadFilePacket", "AdminContinueCameraTranslationPacket", "AdminContinueMicrophoneTranslationPacket" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1547.001", "c": 0.699999988079071, "d": "CurrentVersion Run path", "e": [ "…tware\\Microsoft\\Windows\\CurrentVersion\\Run\" /v PeerCreator /t REG_…" ], "i": "objectives/persistence/login/startup/registry::currentversion-run", "l": 1 }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-4--inline-29205", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links d3d11.dll (D3D11CreateDevice)", "e": [ "d3d11.dll" ], "i": "metadata/dylib::d3d11/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MFPlat.DLL (MFShutdown, MFCreateAttributes, MFCreateMediaType, MFStartup)", "e": [ "MFPlat.DLL" ], "i": "metadata/dylib::mfplat/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MFReadWrite.dll (MFCreateSourceReaderFromMediaSource)", "e": [ "MFReadWrite.dll" ], "i": "metadata/dylib::mfreadwrite/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoInitialize, PropVariantClear, CoCreateInstance, CoSetProxyBlanket, CoTaskMemFree, ... +3 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (LoadStringW, EnumDisplayMonitors, SendInput, GetSystemMetrics, GetMonitorInfoW)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 2, ORDINAL 6, ORDINAL 9)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (OutputDebugStringA, GetLogicalProcessorInformation, HeapSize, WriteConsoleW, GetProcessHeap, ... +165 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WINHTTP.dll (WinHttpOpen, WinHttpCloseHandle, WinHttpConnect, WinHttpReceiveResponse, WinHttpSendRequest, ... +3 more)", "e": [ "WINHTTP.dll" ], "i": "metadata/dylib::winhttp/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (CheckTokenMembership, AllocateAndInitializeSid, GetUserNameA, FreeSid)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteA, SHGetFolderPathA, ShellExecuteExW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WS2_32.dll (ORDINAL 111, ORDINAL 3, ORDINAL 115, ORDINAL 23, ORDINAL 4, ... +6 more)", "e": [ "WS2_32.dll" ], "i": "metadata/dylib::ws2_32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MF.dll (MFEnumDeviceSources)", "e": [ "MF.dll" ], "i": "metadata/dylib::mf/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links IPHLPAPI.DLL (GetAdaptersAddresses)", "e": [ "IPHLPAPI.DLL" ], "i": "metadata/dylib::iphlpapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links dbghelp.dll (SymFromAddr)", "e": [ "dbghelp.dll" ], "i": "metadata/dylib::dbghelp/dll", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "WinHTTP request response data flow", "e": [ "WinHttpReadData", "WinHttpReceiveResponse", "WinHttpOpenRequest", "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client::winhttp-request-flow", "l": 3, "m": "C0002" }, { "c": 0.8799999952316284, "d": "Winsock outbound connect import", "e": [ "WS2_32.dll", "ORDINAL 4" ], "i": "micro-behaviors/communications/socket/init::connect-api-ordinal", "l": 3 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 224.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetModuleHandleExW", "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "EnumSystemLocalesW", "GetUserDefaultLCID", "GetLocaleInfoW", "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform::locale-environment-fingerprint", "l": 2 }, { "a": "T1071.001", "c": 0.9200000166893005, "d": "WinHTTP session with remote connection", "e": [ "WinHttpSetTimeouts", "WinHttpOpen", "WinHttpConnect" ], "i": "micro-behaviors/communications/http/client::winhttp-session-connect-flow", "l": 3, "m": "C0002" }, { "c": 0.8399999737739563, "d": "Network byte order conversion", "e": [ "WS2_32.dll", "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::htons-api-ordinal", "l": 3 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempPathW", "MoveFileExW", "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "a": "T1057", "c": 0.8999999761581421, "d": "Toolhelp process enumeration via imports", "e": [ "Process32NextW", "CreateToolhelp32Snapshot", "Process32FirstW" ], "i": "micro-behaviors/process/enumerate/snapshot::toolhelp-process-enumeration-symbol", "l": 3 }, { "a": "T1129", "c": 0.699999988079071, "d": "SRW lock operations", "e": [ "AcquireSRWLockExclusive", "ReleaseSRWLockExclusive" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-ops", "l": 2 }, { "c": 0.75, "d": "Worker threads with synchronization", "e": [ "CreateThread", "RtlCaptureContext", "VirtualAlloc" ], "i": "micro-behaviors/process/threading/async::worker-pool-comp", "l": 2 }, { "c": 0.8999999761581421, "d": "Pipe creation with handle redirect", "e": [ "CreatePipe", "SetStdHandle" ], "i": "micro-behaviors/communications/ipc/pipe::pipe-io-redirect", "l": 3 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsSetValue", "FlsAlloc", "FlsGetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "c": 0.8600000143051147, "d": "Winsock receive import", "e": [ "ORDINAL 16", "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::recv-api-ordinal", "l": 3 }, { "a": "T1204.002", "c": 0.9300000071525574, "d": "schtasks creates task from remote UNC XML", "e": [ "schtasks /Query /TN \"PeerCreator\"", "schtasks /Create /TN \"PeerCreator\" /TR \"" ], "i": "objectives/command-and-control/dropper/execution/clickfix::schtasks-remote-unc-xml", "l": 4, "m": "B0024" }, { "c": 0.8600000143051147, "d": "Winsock send import", "e": [ "WS2_32.dll", "ORDINAL 19" ], "i": "micro-behaviors/communications/socket/init::send-api-ordinal", "l": 3 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "CreateFileW", "GetModuleFileNameA", "ReadFile", "SetFilePointerEx" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "EnumSystemLocalesW", "GetLocaleInfoW", "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::locale-fingerprinting-imports", "l": 2 }, { "c": 0.8799999952316284, "d": "Winsock socket creation import", "e": [ "ORDINAL 23", "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::socket-api-ordinal", "l": 3 }, { "c": 0.800000011920929, "d": "Has file operation capabilities", "e": [ "MoveFileExW", "FindFirstFileW" ], "i": "objectives/impact/ransom/file-operations::has-file-operations", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindNextFileW", "FindClose", "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "COM proxy setup for WMI automation", "e": [ "CoCreateInstance", "CoInitializeSecurity", "CoSetProxyBlanket", "CoInitializeEx" ], "i": "micro-behaviors/os/com/invoke::wmi-com-proxy-setup", "l": 3 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "SetFileTime", "GetModuleFileNameW", "FindFirstFileW", "CreateFileW", "GetModuleFileNameA", "WriteFile" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "c": 0.8600000143051147, "d": "Initialize Winsock library", "e": [ "WS2_32.dll", "ORDINAL 115" ], "i": "micro-behaviors/communications/socket/init::winsock-startup-ordinal", "l": 3 }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "LoadResource", "SizeofResource", "FindResourceExW", "LockResource", "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-full-extraction", "l": 3 }, { "a": "T1129", "c": 0.75, "d": "Advanced sync primitives", "e": [ "WakeAllConditionVariable", "ReleaseSRWLockExclusive", "WakeConditionVariable", "AcquireSRWLockExclusive", "SleepConditionVariableSRW" ], "i": "micro-behaviors/process/threading/advanced-sync::advanced-sync-primitives", "l": 2 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "FindResourceExW", "FindResourceW", "LoadResource", "LockResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1071.001", "c": 0.9399999976158142, "d": "WinHTTP download session and response flow", "e": [ "WinHttpOpenRequest", "WinHttpOpen", "WinHttpCloseHandle", "WinHttpConnect", "WinHttpSetTimeouts", "WinHttpReceiveResponse", "WinHttpReadData", "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client::winhttp-downloader-flow", "l": 3, "m": "C0002" }, { "c": 0.9800000190734863, "d": "Toolhelp process termination API cluster", "e": [ "Process32FirstW", "Process32NextW", "CreateToolhelp32Snapshot", "TerminateProcess", "OpenProcess" ], "i": "micro-behaviors/process/terminate/kill::toolhelp-kill-loop-source", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamic Toolhelp enumeration suite", "e": [ "GetProcAddress", "CreateToolhelp32Snapshot", "Process32FirstW", "Process32NextW" ], "i": "micro-behaviors/process/enumerate/snapshot::dynamic-toolhelp-enumerator", "l": 3 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00", "binary.has_signature = 0.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "c": 0.8500000238418579, "d": "Resource extraction to temp directory", "e": [ "LockResource", "GetTempPathW", "GetTempPathA", "SizeofResource", "FindResourceW", "LoadResource", "FindResourceExW" ], "i": "objectives/command-and-control/dropper/staging/embedded::pe-resource-temp-stager-persistence-chain", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "EnumSystemLocalesEx", "GetUserDefaultLCID", "EnumSystemLocalesW", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetLocaleInfoW" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Large high-entropy overlay", "e": [ "binary.overlay_size = 4147872.00", "binary.overlay_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-entropy-overlay", "l": 4, "m": "B0032" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading API chain", "e": [ "SetFilePointerEx", "GetModuleFileNameA", "ReadFile", "binary.has_overlay = 1.00", "CreateFileW" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-chain", "l": 4, "m": "B0032" }, { "a": "T1204", "c": 0.8999999761581421, "d": "Self-mapping dropper extracts and executes payload", "e": [ "CreateFileMappingW", "GetModuleFileNameA", "GetModuleFileNameW", "WriteFile", "ShellExecuteExW", "CreateProcessW" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute", "l": 2 }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "a": "T1105", "c": 0.949999988079071, "d": "Temp staged file copy with shell handoff", "e": [ "GetModuleFileNameW", "GetModuleFileNameA", "GetTempPathA", "GetTempPathW", "MoveFileExW", "CopyFileA", "ShellExecuteA" ], "i": "objectives/command-and-control/dropper/execution/loader::temp-copy-shell-handoff", "l": 2, "m": "B0024" }, { "c": 0.800000011920929, "d": "Process enumeration capability (for targeting)", "e": [ "Process32FirstW", "CreateToolhelp32Snapshot" ], "i": "objectives/impact/degrade/edr/targeting::process-enumeration", "l": 3, "m": "C0003" }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "GetUserDefaultLCID", "EnumSystemLocalesW", "GetCurrentThreadId", "GetCommandLineA", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetCommandLineW", "GetLocaleInfoW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large binary with low average complexity", "e": [ "binary.avg_complexity = 7.76", "binary.func_count = 6422.00", "binary.string_count = 4135.00", "virussign.com_75055681acee4098daf34250c61c75e0.vir", "binary.overall_entropy = 5.22" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-binary-low-average-complexity", "l": 2, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Multiple WMI host profile queries", "e": [ "Win32_Processor", "Win32_BaseBoard", "Win32_VideoController", "Win32_ComputerSystemProduct" ], "i": "objectives/anti-analysis/vm-detect/wmi::wmi-host-profile-queries", "l": 4, "m": "B0009" }, { "a": "T1057", "c": 0.8999999761581421, "d": "ToolHelp snapshot enumeration with process access", "e": [ "OpenProcess", "CreateToolhelp32Snapshot" ], "i": "objectives/discovery/process/targeting::toolhelp-enumeration-with-access", "l": 3, "m": "E1057" }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" }, { "a": "T1033", "c": 0.8999999761581421, "d": "Admin group SID membership check", "e": [ "CheckTokenMembership", "AllocateAndInitializeSid" ], "i": "micro-behaviors/os/privilege/check::admin-sid-check", "l": 3 }, { "a": "T1082", "c": 0.8999999761581421, "d": "WMI hardware and OS profile query cluster", "e": [ "Win32_Processor", "Win32_ComputerSystemProduct", "Win32_VideoController", "Win32_BaseBoard" ], "i": "objectives/anti-analysis/vm-detect/wmi::wmi-vm-fingerprint", "l": 1, "m": "B0009" }, { "a": "T1082", "c": 0.9200000166893005, "d": "COM-backed WMI host fingerprinting", "e": [ "CoInitializeEx", "Win32_VideoController", "Win32_Processor", "Win32_ComputerSystemProduct", "Win32_BaseBoard", "CoInitializeSecurity", "CoCreateInstance", "CoSetProxyBlanket" ], "i": "objectives/anti-analysis/vm-detect/wmi::com-backed-wmi-fingerprint", "l": 4, "m": "B0009" }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Binary with encrypted overlay payload", "e": [ "binary.overlay_size = 4147872.00", "binary.overlay_entropy = 8.00", "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::binary-encrypted-overlay", "l": 4, "m": "B0032" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "FreeEnvironmentStringsW", "GetCommandLineA", "GetUserDefaultLCID", "GetEnvironmentStringsW", "GetSystemTimeAsFileTime", "GetLocaleInfoW", "EnumSystemLocalesW", "EnumSystemLocalesEx", "GetCommandLineW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082" }, { "a": "T1027.009", "c": 0.9200000166893005, "d": "PE high-entropy overlay with loader APIs", "e": [ "GetModuleFileNameA", "SetFilePointerEx", "binary.has_overlay = 1.00", "binary.overlay_size = 4147872.00", "CreateFileW", "binary.overlay_entropy = 8.00", "ReadFile" ], "i": "objectives/anti-static/obfuscation/binary-metrics::pe-encrypted-overlay-dropper", "l": 4, "m": "B0032" } ], "sha": "1bf2e4461db1c8d56eeeb202c80bc2cbb57db66d97d37bb404347c03ffdf733a", "path": "virussign.com_75055681acee4098daf34250c61c75e0.vir", "type": "pe" } ], "tv": "27ac5" } }