{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9984655380249023, "class": 2 }, { "id": 1, "prob": 0.9969539642333984, "class": 1 } ], "prob": 0.99846554, "class": 2, "models": [ { "m": "az", "prob": 0.99846554, "class": 1 }, { "m": "az/archive", "prob": 0.9979405, "class": 0 }, { "m": "az/zip", "prob": 0.9881045, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9958679, 0.99937946 ], "analyzed_at": "2026-05-05T12:24:04Z" }, "path": "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77.zip", "raw": { "v": "4", "fs": [ { "f": "K₂O₁₀(I₅PrAs₁₀Dy₂Er₇Al₃C₄CaLaP₂)H₇(Os₃Cm₃Cr₂F₄Po₆TiDb₃)Md₂(Bi₅Si)", "k": { "jar.entry_count": 1 }, "x": 129, "id": 0, "ms": { "file": { "size": 557055.0 } }, "ss": [ [ 1265118, "https://secure.comodo.net/CPS0C" ], [ 1265310, "http://ocsp.comodoca.com0!" ], [ 1266597, "http://ocsp.comodoca.com0" ] ], "sz": 557055, "ts": [ { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "FreeEnvironmentStringsW", "EnumSystemLocalesEx", "GetUserDefaultLCID", "GetEnvironmentStringsW", "GetLocaleInfoW", "EnumSystemLocalesW" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082" }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1795.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "ntdll.dll" ], "i": "objectives/evasion/anti-av/platform::ntdll-dll-str", "l": 1 }, { "c": 1.0, "d": "Signed by MIKL LIMITED", "e": [ "MIKL LIMITED" ], "i": "metadata/signed/leaf::mikl-limited", "l": 3 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CloseHandle, DuplicateHandle, UnmapViewOfFile, CreateFileMappingA, MapViewOfFileEx, ... +151 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8999999761581421, "d": "Pipe creation with handle redirect", "e": [ "DuplicateHandle", "SetStdHandle", "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::pipe-io-redirect", "l": 3 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "a": "T1204", "c": 0.8999999761581421, "d": "Self-mapping dropper extracts and executes payload", "e": [ "CreateProcessW", "GetModuleFileNameA", "UnmapViewOfFile", "WriteFile", "GetModuleFileNameW" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute", "l": 2 }, { "a": "T1548.002", "c": 0.8999999761581421, "d": "Auto-elevation without trusted signature", "e": [ "\u003cautoElevate\u003etrue" ], "i": "objectives/privilege-escalation/elevation-control/uac-bypass/manifest::unsigned-auto-elevate", "l": 4 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-dialogbox-l1-1-0", "ext-ms-win-ntuser-windowstation-l1-1-0", "ext-ms-win-kernel32-package-current-l1-1-0" ], "i": "metadata/binary/linking::api-set-ext-cluster", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.6000000238418579, "d": "\"pay...bitcoin\" ransom phrase", "e": [ "payment has to be made in Bitcoin" ], "i": "micro-behaviors/data/text/malware::pay-bitcoin-phrase", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1486", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ ".?AVTF_EncryptorBase@CryptoPP@@", "void __thiscall boost::concurrent::detail::sync_queue_base\u003cstruct crypto_locker::path_entry,class boost::detail::priority_queue\u003c", ".?AV?$AlgorithmImpl@VTF_EncryptorBase@CryptoPP@@V?$TF_ES@URSA@CryptoPP@@V?$OAEP@VSHA1@CryptoPP@@VP1363_MGF1@2@@2@H@2@@CryptoPP@@", "E:\\crypto-locker\\cryptopp\\src\\rijndael_simd.cpp", "Greetings!\n\nThere was a significant flaw in the security system of your company.\nYou should be thankful that the flaw was exploi", ".?AVPK_Encryptor@CryptoPP@@", ".?AV?$TF_ObjectImpl@VTF_EncryptorBase@CryptoPP@@U?$TF_CryptoSchemeOptions@V?$TF_ES@URSA@CryptoPP@@V?$OAEP@VSHA1@CryptoPP@@VP1363", ".?AV?$TF_ObjectImplBase@VTF_EncryptorBase@CryptoPP@@U?$TF_CryptoSchemeOptions@V?$TF_ES@URSA@CryptoPP@@V?$OAEP@VSHA1@CryptoPP@@VP", "E:\\crypto-locker\\cryptopp\\src\\sse_simd.cpp", ".?AV?$PK_FixedLengthCryptoSystemImpl@VPK_Encryptor@CryptoPP@@@CryptoPP@@", ".?AV?$TF_CryptoSystemBase@VPK_Encryptor@CryptoPP@@V?$TF_Base@VRandomizedTrapdoorFunction@CryptoPP@@VPK_EncryptionMessageEncoding", "E:\\crypto-locker\\cryptopp\\src\\crc_simd.cpp", "E:\\crypto-locker\\tpls_MSVC\\include\\boost-1_68\\boost/exception/detail/exception_ptr.hpp", "E:\\crypto-locker\\cryptopp\\src\\sha_simd.cpp", ".?AV?$TF_EncryptorImpl@U?$TF_CryptoSchemeOptions@V?$TF_ES@URSA@CryptoPP@@V?$OAEP@VSHA1@CryptoPP@@VP1363_MGF1@2@@2@H@CryptoPP@@UR", "E:\\crypto-locker\\tpls_MSVC\\include\\boost-1_68\\boost/thread/concurrent_queues/detail/sync_queue_base.hpp" ], "i": "objectives/impact/ransom/encrypt/hybrid::rust-ransomware-module-set--rx-5", "l": 1, "m": "B0040" }, { "c": 0.8999999761581421, "d": "Timer queue create + delete lifecycle", "e": [ "DeleteTimerQueueTimer", "CreateTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback::timer-queue-lifecycle", "l": 2 }, { "c": 0.8999999761581421, "d": "Native runtime has many functions", "e": [ "binary.func_count = 4067.00" ], "i": "metadata/lang/compiler/aot::huge-runtime-function-count", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: COMODO RSA Code Signing CA", "e": [ "COMODO RSA Code Signing CA" ], "i": "metadata/signed/developer::comodo-rsa-code-signing-ca", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW", "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "SHGetFolderPathW", "PathIsNetworkPathA", "GetTempPathW" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.9900000095367432, "d": "MSVC C++ runtime strerror diagnostic string", "e": [ "Visual C++ CRT: Not enough memory to complete call to strerror." ], "i": "objectives/evasion/process/injection::msvc-crt-strerror-string", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 4067.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "d": "\"your files\" ransom phrase", "e": [ "Your files are" ], "i": "micro-behaviors/data/text/malware::your-files-phrase", "l": 2 }, { "c": 0.8999999761581421, "d": "Release cryptographic context", "e": [ "CryptReleaseContext" ], "i": "micro-behaviors/crypto/library::crypt-release-context", "l": 2 }, { "c": 1.0, "d": "Cert chain has only 2 entries", "e": [ "pe.cert_chain_depth = 2.00" ], "i": "metadata/signed::pe-cert-shallow-chain", "l": 3 }, { "c": 0.949999988079071, "d": "XORed Cobalt Strike config marker", "e": [ "EF BE [2] BE B7" ], "i": "well-known/malware/rat/cobalt-strike::xored-config-beef-rdata", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "a": "T1486", "c": 0.699999988079071, "d": "Regex component marker", "e": [ "README-NOW.txt" ], "i": "objectives/impact/ransom/native::readme-note-file--rx-1", "l": 1, "m": "C0027" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceExW" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "FileSink: output stream not opened", "Input/output error" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoCreateInstance, CoUninitialize, CoInitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "CreateFileW", "CreateFileA", "ReadFile", "GetModuleFileNameA", "SetFilePointerEx" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "GetCommandLineA", "GetUserDefaultLCID", "EnumSystemLocalesW", "GetCurrentThreadId", "GetEnvironmentStringsW", "GetCommandLineW", "FreeEnvironmentStringsW", "GetLocaleInfoW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082" }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1573", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "StreamTransformationFilter: ciphertext length is not a multiple of block size", ".?AVInvalidCiphertext@CryptoPP@@" ], "i": "micro-behaviors/crypto/asymmetric/kem::kyber-encapsulation-terms--rx-1", "l": 1, "m": "C0027" }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1795.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically push entry to thread-safe list", "e": [ "InterlockedPushEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-push-entry-slist", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8500000238418579, "d": "Wait on multiple handles extended", "e": [ "WaitForMultipleObjectsEx" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects-ex", "l": 2, "m": "C0042" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Set thread CPU affinity", "e": [ "SetThreadAffinityMask" ], "i": "micro-behaviors/process/control/affinity::set-thread-affinity-mask", "l": 3 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{C15730E2-145C-4c5e-B005-3BC753F42475}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetLocaleInfoW", "EnumSystemLocalesEx", "GetUserDefaultLCID", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::locale-environment-fingerprint", "l": 2 }, { "c": 0.8999999761581421, "d": "Set security descriptor DACL", "e": [ "SetSecurityDescriptorDacl" ], "i": "micro-behaviors/os/security/descriptor::set-security-descriptor-dacl", "l": 2 }, { "a": "T1574", "c": 0.8999999761581421, "d": "Disable WoW64 filesystem redirection", "e": [ "Wow64DisableWow64FsRedirection" ], "i": "micro-behaviors/os/compat/wow64::wow64-disable-redirect", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 2, "m": "F0007" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InitializeSListHead", "InterlockedPushEntrySList", "InterlockedPopEntrySList", "InterlockedFlushSList" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 0.20000000298023224, "d": "crypto keyword (word match)", "e": [ "crypto" ], "i": "micro-behaviors/data/text/keywords::crypto-word", "l": 1 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ ".?AVX509PublicKey@CryptoPP@@", "for this public key", ".?AV?$ASN1CryptoMaterial@VPublicKey@CryptoPP@@@CryptoPP@@", ".?AVPublicKey@CryptoPP@@", "PublicExponent", "spanish-dominican republic", ".?AVPublicKeyAlgorithm@CryptoPP@@" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ ".?AUshared_state_base@detail@boost@@", ".?AV?$sp_counted_impl_p@U?$task_shared_state@V?$_Binder@U_Unforced@std@@AAV\u003clambda_8a7570b976bc101d83292d43f9603e9c\u003e@@HI@std@@X@", ".?AU?$task_shared_state@V?$_Binder@U_Unforced@std@@AAV\u003clambda_8a7570b976bc101d83292d43f9603e9c\u003e@@HI@std@@X@detail@boost@@", ".?AU?$task_base_shared_state@X@detail@boost@@", ".?AV?$enable_shared_from_this@Ushared_state_base@detail@boost@@@boost@@", ".?AU?$shared_state@X@detail@boost@@" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-6", "l": 1, "m": "C0027" }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll", "Wkernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 36308.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 4067.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetFolderPathW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreA" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (CryptReleaseContext, CryptAcquireContextA, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, CryptGenRandom)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-4--inline-29205", "l": 1, "m": "B0032" }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ ".?AVResourceManager@details@Concurrency@@", ".?AUIResourceManager@Concurrency@@" ], "i": "micro-behaviors/data/embedded/payload::dotnet-resource-manager-token", "l": 1, "m": "F0001.006" }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1795.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 166.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".?AVCacheLocalScheduleGroupSegment@details@Concurrency@@", ".?AVCacheLocalScheduleGroup@details@Concurrency@@", "LocalContextCacheSize", "|.*\\\\(readme-now\\.txt|(ntuser|usrclass)\\.(dat|ini)|desktop\\.ini|.+\\.(lnk|sys|dll|locked)|microsoft\\\\windows\\\\burn|gdipfontcachev" ], "i": "objectives/command-and-control/dropper/staging::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.8999999761581421, "d": "DeleteTimerQueueTimer symbol", "e": [ "DeleteTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback::delete-timer-queue-timer-sym", "l": 2 }, { "c": 0.75, "d": "CreateTimerQueue import (rare, common padding symbol)", "e": [ "CreateTimerQueue" ], "i": "metadata/binary/anomaly::import-padding-timer-queue", "l": 1 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "thread_pool", "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: COMODO RSA Certification Authority", "e": [ "COMODO RSA Certification Authority" ], "i": "metadata/signed/developer::comodo-rsa-certification-authority", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 3 }, { "c": 0.800000011920929, "d": "Query file attributes and timestamps", "e": [ "GetFileAttributesExW" ], "i": "micro-behaviors/fs/file/timestamp::get-file-attributes-ex", "l": 2 }, { "c": 0.4000000059604645, "d": "cipher keyword", "e": [ "cipher" ], "i": "micro-behaviors/crypto/library::cipher-keyword", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1102", "c": 0.7200000286102295, "d": "EVM function selector literal", "e": [ "0x50b61c8d" ], "i": "objectives/command-and-control/infrastructure/blockchain/polygon::evm-selector-hex-literal", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.49" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetModuleHandleW", "GetProcAddress", "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004" }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "FNV-1a 32-bit prime constant (0x01000193)", "e": [ "93 01 00 01" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-32bit-literal", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Sparse-import evasive PE loader", "e": [ "binary.import_count = 166.00", "binary.text_to_file_ratio = 0.73", "binary.behavioral_import_ratio = 0.04", "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::sparse-import-evasive-pe", "l": 3, "m": "B0032" }, { "d": "POSIX \"Permission denied\" error message", "e": [ "Permission denied" ], "i": "micro-behaviors/os/message/error::permission-denied", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "a": "T1204.002", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "CreateThreadpoolTimer", "CreateEventA", "CreateSymbolicLinkW", "CreateProcess failed", "CreateSemaphoreA", "CreateProcessW", "CreateSemaphoreExW", "CreateFileMappingA", "CreateThreadpoolWork", "CreatePipe", "CreatePipe() failed", "create log", "CreateSemaphoreW", "CreateFileA", "CreateThreadpoolWait", "CreateEventExW" ], "i": "objectives/command-and-control/dropper/execution/clickfix::schtasks-remote-unc-xml--rx-3", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Query and modify CPU affinity", "e": [ "SetThreadAffinityMask", "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::affinity-mask-control", "l": 3 }, { "c": 0.8799999952316284, "d": "Configure waitable timer", "e": [ "SetWaitableTimer" ], "i": "micro-behaviors/time/schedule/waitable::set-waitable-timer", "l": 3 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesW", "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "a": "T1567.002", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ": this object doesn't support resynchronization", "void __thiscall boost::concurrent::detail::sync_queue_base\u003cstruct crypto_locker::path_entry,class boost::detail::priority_queue\u003c", "E:\\crypto-locker\\tpls_MSVC\\include\\boost-1_68\\boost/thread/concurrent_queues/detail/sync_queue_base.hpp", "api-ms-win-core-synch-l1-2-0", ".?AUsync_queue_is_closed@concurrent@boost@@", "void __thiscall boost::concurrent::detail::sync_queue_base\u003cclass boost::detail::nullary_function\u003cvoid __cdecl(void)\u003e,class boost", ".?AU?$error_info_injector@Usync_queue_is_closed@concurrent@boost@@@exception_detail@boost@@", ".?AV?$clone_impl@U?$error_info_injector@Usync_queue_is_closed@concurrent@boost@@@exception_detail@boost@@@exception_detail@boost" ], "i": "well-known/tool/dual-use/megacmd::megacmd-binary-name--rx-5", "l": 1, "m": "B0030" }, { "c": 0.8799999952316284, "d": "Overlay manifest requires administrator", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator-overlay", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "E:\\crypto-locker\\cryptopp\\src\\sse_simd.cpp", "E:\\crypto-locker\\cryptopp\\src\\rijndael_simd.cpp", "…re as Photorec, RannohDecryptor etc.\nwill lead to irre…", "E:\\crypto-locker\\tpls_MSVC\\include\\boost-1_68\\boost/exception/detail/exception_ptr.hpp", "…r::new_allocator\u003cstruct crypto_locker::path_entry\u003e,voi…", "E:\\crypto-locker\\cryptopp\\src\\crc_simd.cpp", "E:\\crypto-locker\\cryptopp\\src\\sha_simd.cpp", "…:sync_queue_base\u003cstruct crypto_locker::path_entry,clas…", "…struct std::less\u003cstruct crypto_locker::path_entry\u003e \u003e \u003e…", "…ontainer::vector\u003cstruct crypto_locker::path_entry,clas…", "…::priority_queue\u003cstruct crypto_locker::path_entry,clas…", "E:\\crypto-locker\\tpls_MSVC\\includ…" ], "i": "micro-behaviors/data/text/keywords::crypto-substr", "l": 1 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Acquire cryptographic service provider context", "e": [ "CryptAcquireContextA" ], "i": "micro-behaviors/crypto/library::crypt-acquire-context", "l": 3, "m": "C0027" }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "MoveFileExW", "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "c": 0.800000011920929, "d": "Initialize security descriptor", "e": [ "InitializeSecurityDescriptor" ], "i": "micro-behaviors/os/security/descriptor::initialize-security-descriptor", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1486", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "Greetings!\n\nThere was a significant flaw in the security system of your company.\nYou should be thankful that the flaw was exploi", ": this key is too short to encrypt any messages", "encrypting:", "encrypting!" ], "i": "objectives/impact/ransom/encrypt/hybrid::rust-ransomware-module-set--rx-4", "l": 1, "m": "B0040" }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.func_count = 4067.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateTimerQueueTimer symbol", "e": [ "CreateTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback::create-timer-queue-timer-sym", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "encrypt" ], "i": "micro-behaviors/crypto/library::encrypt-fn", "l": 3 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "UnmapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.800000011920929, "d": "Revert WoW64 filesystem redirection", "e": [ "Wow64RevertWow64FsRedirection" ], "i": "micro-behaviors/os/compat/wow64::wow64-revert-redirect", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "not connected", "already connected" ], "i": "micro-behaviors/communications/http/llm::gpt-proxy-websocket-upstream--rx-13", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "GetStringTypeW", "string too long", "FreeEnvironmentStringsW", "boost::filesystem::path codecvt to wstring", "GetLogicalDriveStringsW", "GetEnvironmentStringsW", ".?AV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@s", "api-ms-win-core-string-l1-1-0", "invalid string position", "LCMapStringW", "StringNarrow: wcstombs_s() call failed with error", "CompareStringW", "StringStore: missing InputBuffer argument", "CompareStringEx", "LCMapStringEx", "\u003cunrepresentable unicode string\u003e" ], "i": "micro-behaviors/communications/http/client::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 33088.00" ], "i": "metadata/hardening::no-aslr-bit", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.75" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "a": "T1106", "c": 0.8500000238418579, "d": "CreateProcessW API string", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w-string", "l": 3 }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "EnumSystemLocalesW", "GetLocaleInfoW", "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::locale-fingerprinting-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 3 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ ".?AVinvalid_command_line_syntax@program_options@boost@@", "too many positional options have been specified on the command line", "unknown command line syntax error for '%s'", "…_info_injector@Vinvalid_command_line_syntax@program_opt…" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "void __thiscall boost::concurrent::detail::sync_queue_base\u003cstruct crypto_locker::path_entry,class boost::detail::priority_queue\u003c", "CloseHandle", ".?AU?$error_info_injector@Usync_queue_is_closed@concurrent@boost@@@exception_detail@boost@@", "CloseThreadpoolWait", "CloseThreadpoolWork", ".?AV?$clone_impl@U?$error_info_injector@Usync_queue_is_closed@concurrent@boost@@@exception_detail@boost@@@exception_detail@boost", "NtClose", ".?AUsync_queue_is_closed@concurrent@boost@@", "FindClose", "CloseThreadpoolTimer", "void __thiscall boost::concurrent::detail::sync_queue_base\u003cclass boost::detail::nullary_function\u003cvoid __cdecl(void)\u003e,class boost" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder path via Shell32", "e": [ "SHGetFolderPathW" ], "i": "micro-behaviors/fs/shell-ops::shell-get-folder-path", "l": 2 }, { "c": 0.8500000238418579, "d": "File API ANSI check", "e": [ "AreFileApisANSI" ], "i": "micro-behaviors/os/env/access::are-file-apis-ansi", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 166.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "too many links", "Too many links" ], "i": "objectives/evasion/process::exe-in-media-folder--rx-6", "l": 1 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.38" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "One .text section dominates file", "e": [ "binary.text_to_file_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::text-heavy-binary", "l": 1, "m": "B0032" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceExW" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 4067.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.800000011920929, "d": "Auto-elevation manifest attribute", "e": [ "\u003cautoElevate\u003etrue" ], "i": "micro-behaviors/os/privilege/manifest::auto-elevate", "l": 4 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1055.012", "c": 0.6000000238418579, "d": "ResumeThread call", "e": [ "ResumeThread" ], "i": "objectives/evasion/process/injection/hollowing::resume-thread", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (PathIsNetworkPathA)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "a": "T1055", "c": 0.8999999761581421, "d": "ResumeThread API reference", "e": [ "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime::resume-thread-dup", "l": 3 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::get-user-default-lcid", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 4067.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ ".?AVInvalidCiphertext@CryptoPP@@", "StreamTransformationFilter: ciphertext length is not a multiple of block size" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-1", "l": 1, "m": "C0027" }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcess failed", "CreateProcessW" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "Too many links", "too many links" ], "i": "objectives/evasion/masquerade/file/suspicious-path::exe-in-media-folder--rx-6", "l": 1 }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE TLS callback table present", "e": [ "pe.tls_callbacks = 1.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-callbacks-metric", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.func_count = 4067.00" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute-cond-4--inline-11988", "l": 1 }, { "c": 0.9700000286102295, "d": "Signed PE wrapper marker", "e": [ "pe.has_signature = 1.00" ], "i": "metadata/binary/layout::signed-pe-wrapper", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "advapi32.dll", "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "a": "T1573", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ ".?AU?$shared_state@X@detail@boost@@", ".?AV?$enable_shared_from_this@Ushared_state_base@detail@boost@@@boost@@", ".?AU?$task_shared_state@V?$_Binder@U_Unforced@std@@AAV\u003clambda_8a7570b976bc101d83292d43f9603e9c\u003e@@HI@std@@X@detail@boost@@", ".?AV?$sp_counted_impl_p@U?$task_shared_state@V?$_Binder@U_Unforced@std@@AAV\u003clambda_8a7570b976bc101d83292d43f9603e9c\u003e@@HI@std@@X@", ".?AUshared_state_base@detail@boost@@", ".?AU?$task_base_shared_state@X@detail@boost@@" ], "i": "micro-behaviors/crypto/asymmetric/kem::kyber-encapsulation-terms--rx-5", "l": 1, "m": "C0027" }, { "c": 0.8999999761581421, "d": "Atomically pop entry from thread-safe list", "e": [ "InterlockedPopEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-pop-entry-slist", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.func_count = 4067.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-string-l1-1-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-file-l2-1-1", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-winrt-l1-1-0" ], "i": "metadata/binary/linking::api-set-core-cluster", "l": 1 }, { "a": "T1486", "c": 0.699999988079071, "d": "ProtonMail contact address", "e": [ "AbbsChevis@protonmail.com" ], "i": "objectives/impact/ransom/native::protonmail-contact", "l": 3, "m": "C0027" }, { "a": "T1083", "c": 0.8999999761581421, "d": "Enumerate logical drive strings", "e": [ "GetLogicalDriveStringsW" ], "i": "micro-behaviors/fs/traversal/drives::get-logical-drive-strings", "l": 3, "m": "E1083" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: MIKL LIMITED", "e": [ "MIKL LIMITED" ], "i": "metadata/signed/developer::mikl-limited", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (Unicode)", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w", "l": 3 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "a": "T1091", "c": 0.8799999952316284, "d": "Windows drive type query", "e": [ "GetDriveTypeW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-drive-type-w", "l": 1, "m": "B0017" }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "a": "T1497.003", "c": 0.699999988079071, "d": "QueryPerformanceFrequency timing", "e": [ "QueryPerformanceFrequency" ], "i": "micro-behaviors/time/timing/check::query-performance-frequency", "l": 2, "m": "B0003.003" }, { "a": "T1486", "c": 0.9200000166893005, "d": "READ_ME_NOW ransom note", "e": [ "README-NOW.txt" ], "i": "objectives/impact/ransom/encrypt/hybrid::ransom-note-read-me-now", "l": 4, "m": "B0040" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8500000238418579, "d": "Open named event object", "e": [ "OpenEventA" ], "i": "micro-behaviors/process/sync/event::open-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Atomically flush thread-safe list", "e": [ "InterlockedFlushSList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-flush-slist", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 166.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "WaitForThreadpoolTimerCallbacks", "AuthenticatedEncryptionFilter", "RandomNumberStoreSize", "RandomNumberGenerator", "GetSystemDirectory", "QueryPerformanceFrequency", "AlgorithmParametersBase", "RandomNumberGeneratorPointer", "FilterWithBufferedInput", "GetFileInformationByHandleEx", "TruncatedDigestSize", "MontgomeryRepresentation", "InitializeCriticalSectionEx", "RoundUpToMultipleOf" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "cmd.exe command interpreter reference", "e": [ "cmd.exe" ], "i": "micro-behaviors/process/create/exec::cmd-exe-reference", "l": 3 }, { "d": "overflow keyword", "e": [ ".?AVoverflow_error@std@@", "…_std_exception_wrapper@Voverflow_error@std@@@exception_d…", "AllocatorBase: requested size would cause integer overflow", "RoundUpToMultipleOf: integer overflow" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection::enum-locale-callback", "l": 3, "m": "E1106" }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Query timezone configuration", "e": [ "GetTimeZoneInformation" ], "i": "micro-behaviors/time/query::get-timezone-information", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.949999988079071, "d": "Ransom note message patterns", "e": [ "Your files are encrypted" ], "i": "objectives/impact/ransom/encrypt::ransom-note-text", "l": 4 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1091", "c": 0.8600000143051147, "d": "VB6 disk free space check GetDiskFreeSpaceExW", "e": [ "GetDiskFreeSpaceExW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-disk-free-space", "l": 1, "m": "B0017" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large binary with low average complexity", "e": [ "binary.overall_entropy = 5.49", "binary.string_count = 1795.00", "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77", "binary.avg_complexity = 5.75", "binary.func_count = 4067.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-binary-low-average-complexity", "l": 2, "m": "B0032" }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Generate cryptographic random bytes", "e": [ "CryptGenRandom" ], "i": "micro-behaviors/os/random/generator::crypt-gen-random", "l": 2, "m": "C0027" }, { "a": "T1559", "c": 0.8999999761581421, "d": "Create anonymous pipe", "e": [ "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::create-pipe", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with many wide strings", "e": [ "binary.wide_string_count = 263.00" ], "i": "objectives/anti-static/obfuscation/payload/section::heavy-wide-string-corpus", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1548433841.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 0.9800000190734863, "d": "Regex component marker", "e": [ "binary.func_count = 4067.00" ], "i": "micro-behaviors/process/terminate/kill::toolhelp-kill-loop-source-cond-6--inline-3846", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "EnumSystemLocalesW", "EnumSystemLocalesEx", "GetCommandLineA", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetUserDefaultLCID", "GetSystemTimeAsFileTime", "GetLocaleInfoW", "GetCommandLineW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082" }, { "c": 0.8500000238418579, "d": "Semaphore coordination with wait logic", "e": [ "WaitForMultipleObjectsEx", "ReleaseSemaphore", "CreateSemaphoreA" ], "i": "micro-behaviors/process/sync/semaphore::coordinated-semaphore-wait", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.9700000286102295, "d": "Host Process for Windows Services", "e": [ "Host Process for Windows Services" ], "i": "objectives/evasion/masquerade/version-resource/service-host::host-process-service-description", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.63)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1070.004", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "wiping free space", "CreateFileMappingA" ], "i": "objectives/evasion/self-delete/file::ping-self-delete--rx-2", "l": 1 }, { "a": "T1547.001", "c": 0.800000011920929, "d": "Filters files by .lnk extension", "e": [ ".lnk" ], "i": "objectives/persistence/login/startup/shortcut::lnk-endswith-filter", "l": 1 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Query drive type by symbol", "e": [ "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script::cmd-exe-dup", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 166.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.75, "d": "Ransomware tool marker", "e": [ "Your files are encrypted" ], "i": "objectives/impact/ransom/markers::ransomware-banner-core", "l": 4 }, { "a": "T1027.007", "c": 1.0, "d": "ntdll.dll as wide string (runtime resolver)", "e": [ "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::ntdll-wide-string", "l": 1, "m": "B0032.014" }, { "a": "T1497.001", "c": 0.8500000238418579, "d": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "e": [ "GetTickCount", "GetDiskFreeSpaceExW", "GetSystemInfo" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::hardware-fingerprint-cluster", "l": 2, "m": "B0007" }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1566", "c": 0.8500000238418579, "d": "Cordova config allows external domain origin", "e": [ "https://secure.comodo.net/" ], "i": "objectives/credential-access/phishing/workflow::cordova-external-origin", "l": 1 } ], "sha": "56313df9b7610b8bd7bcab781df8059a474f6631246019d3c12e8b837b244050", "path": "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77.zip", "type": "zip" }, { "f": "K₂O₉(I₅PrAs₁₀Dy₂Er₇Al₃C₄LaP₂)H₇(Os₃Cm₃Cr₂F₄Po₆TiDb₃)Md₂(Bi₅Si)", "x": 129, "dp": 1, "id": 1, "is": [ "PathIsNetworkPathA", "CloseHandle", "DuplicateHandle", "UnmapViewOfFile", "CreateFileMappingA", "MapViewOfFileEx", "CreateFileA", "GetSystemInfo", "FormatMessageA", "LocalFree", "GetProcAddress", "GetModuleHandleA", "GetExitCodeProcess", "CreateProcessW", "TerminateProcess", "WaitForSingleObjectEx", "WaitForSingleObject", "CreateEventA", "SetEvent", "CreateSemaphoreA", "ReleaseSemaphore", "AreFileApisANSI", "ReadFile", "WriteFile", "MultiByteToWideChar", "WideCharToMultiByte", "GetSystemDirectoryW", "CreatePipe", "SetHandleInformation", "GetProcessHeap", "HeapAlloc", "GetCurrentProcess", "GetLogicalDriveStringsW", "GetCommandLineW", "GetDriveTypeW", "GetWindowsDirectoryW", "Wow64DisableWow64FsRedirection", "Wow64RevertWow64FsRedirection", "QueryPerformanceCounter", "QueryPerformanceFrequency", "ResetEvent", "WaitForMultipleObjectsEx", "OpenEventA", "SetWaitableTimer", "GetCurrentProcessId", "GetCurrentThreadId", "ResumeThread", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "CreateWaitableTimerA", "SetLastError", "GetCurrentThread", "GetThreadTimes", "FindNextFileA", "FindFirstFileExA", "GetTimeZoneInformation", "HeapSize", "ReadConsoleW", "GetLastError", "SwitchToThread", "Sleep", "WriteConsoleW", "HeapFree", "GetStringTypeW", "FormatMessageW", "GetExitCodeThread", "EnterCriticalSection", "LeaveCriticalSection", "TryEnterCriticalSection", "DeleteCriticalSection", "CreateFileW", "FindClose", "FindFirstFileExW", "FindNextFileW", "GetDiskFreeSpaceExW", "GetFileAttributesExW", "GetFileInformationByHandle", "SetEndOfFile", "SetFileAttributesW", "SetFilePointerEx", "GetTempPathW", "DeleteFileW", "GetFileAttributesW", "RemoveDirectoryW", "GetModuleHandleW", "MoveFileExW", "GetCPInfo", "EncodePointer", "DecodePointer", "InitializeCriticalSectionAndSpinCount", "CreateEventW", "GetSystemTimeAsFileTime", "GetTickCount", "CompareStringW", "LCMapStringW", "GetLocaleInfoW", "InitializeSListHead", "IsProcessorFeaturePresent", "IsDebuggerPresent", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "GetStartupInfoW", "CreateTimerQueue", "SignalObjectAndWait", "CreateThread", "SetThreadPriority", "GetThreadPriority", "GetLogicalProcessorInformation", "CreateTimerQueueTimer", "ChangeTimerQueueTimer", "DeleteTimerQueueTimer", "GetNumaHighestNodeNumber", "GetProcessAffinityMask", "SetThreadAffinityMask", "RegisterWaitForSingleObject", "UnregisterWait", "FreeLibrary", "FreeLibraryAndExitThread", "GetModuleFileNameW", "LoadLibraryExW", "GetVersionExW", "VirtualAlloc", "VirtualProtect", "VirtualFree", "InterlockedPopEntrySList", "InterlockedPushEntrySList", "InterlockedFlushSList", "QueryDepthSList", "UnregisterWaitEx", "LoadLibraryW", "RaiseException", "RtlUnwind", "GetCommandLineA", "ExitThread", "GetModuleHandleExW", "SetEnvironmentVariableA", "ExitProcess", "GetModuleFileNameA", "GetStdHandle", "GetACP", "HeapReAlloc", "GetDateFormatW", "GetTimeFormatW", "IsValidLocale", "GetUserDefaultLCID", "EnumSystemLocalesW", "GetFileType", "FlushFileBuffers", "GetConsoleCP", "GetConsoleMode", "SetStdHandle", "IsValidCodePage", "GetOEMCP", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "SHGetFolderPathW", "CoCreateInstance", "CoUninitialize", "CoInitialize", "CryptReleaseContext", "CryptAcquireContextA", "SetSecurityDescriptorDacl", "InitializeSecurityDescriptor", "CryptGenRandom" ], "ms": { "pe": { "signer": "COMODO RSA Code Signing CA, MIKL LIMITED, COMODO RSA Certification Authority", "machine": 332.0, "checksum": 1294221.0, "has_pogo": true, "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1548433841.0, "image_base": 4194304.0, "leaf_issuer": "COMODO RSA Code Signing CA", "leaf_serial": "3d2580e89526f7852b570654efd9a8bf", "leaf_subject": "MIKL LIMITED", "rsrc_entropy": 4.42, "entry_section": ".text", "has_signature": true, "size_of_image": 1286144.0, "timestamp_day": 25.0, "tls_callbacks": 1.0, "cfg_func_count": 256.0, "checksum_valid": true, "file_alignment": 512.0, "leaf_not_after": 1561507199.0, "primary_signer": "MIKL LIMITED", "resource_count": 2.0, "resource_types": [ "RT_VERSION", "RT_MANIFEST" ], "signature_type": "developer", "timestamp_year": 2019.0, "characteristics": 258.0, "entry_point_rva": 621060.0, "leaf_not_before": 1529884800.0, "security_cookie": 5284064.0, "size_of_headers": 1024.0, "timestamp_month": 1.0, "cert_chain_depth": 2.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 5.0, "manifest_present": true, "se_handler_count": 5132972.0, "certificate_count": 1.0, "computed_checksum": 1294221.0, "section_alignment": 4096.0, "cert_validity_days": 365.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1548433841.0, "debug_timestamp_min": 1548433841.0, "dll_characteristics": 33088.0, "rich_header_present": true, "leaf_thumbprint_sha1": "c1b4d57a36e0b6853dd38e3034edf7d99a8b73ad", "linker_major_version": 14.0, "linker_minor_version": 16.0, "version_info_present": true, "debug_directory_types": [ 13.0 ], "api_hashing_indicators": 1.0, "certificate_table_size": 3600.0, "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "file": { "size": 1267728.0 }, "binary": { "code_size": 930304.0, "func_count": 4067.0, "entry_point": 621060.0, "code_entropy": 6.63, "data_entropy": 4.93, "func_density": 4.48, "import_count": 166.0, "string_count": 1795.0, "avg_func_size": 491.45, "has_signature": true, "section_count": 5.0, "avg_complexity": 5.75, "import_density": 0.18, "max_complexity": 269.0, "string_density": 1.98, "overall_entropy": 5.49, "avg_basic_blocks": 8.93, "avg_section_size": 252620.8, "dependency_count": 5.0, "entropy_variance": 0.92, "avg_string_length": 32.74, "complexity_per_kb": 0.01, "max_string_length": 1394.0, "wide_string_count": 263.0, "writable_sections": 1.0, "avg_string_entropy": 3.38, "code_to_data_ratio": 2.8, "data_to_file_ratio": 0.03, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.73, "total_basic_blocks": 36308.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "high_entropy_strings": 3.0, "string_length_stddev": 53.33, "debug_reference_count": 1.0, "high_complexity_funcs": 31.0, "largest_section_ratio": 0.73, "sentence_string_count": 261.0, "sentence_string_ratio": 0.15, "behavioral_import_ratio": 0.04 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 536, ".text" ], [ 615, "@.data" ], [ 656, ".rsrc" ], [ 695, "@.reloc" ], [ 3952, "PQVW" ], [ 5408, "PQSVW" ], [ 8033, "SVWP" ], [ 16899, "DSVW" ], [ 16993, "wkQQSWP" ], [ 18512, "PSVW" ], [ 21501, "VWPQ" ], [ 21527, "VPRQ" ], [ 21921, "VQRP" ], [ 27648, "WQPR" ], [ 31878, "SVW9M" ], [ 33049, "QPVS" ], [ 39475, "8SVW" ], [ 49939, "D8 L" ], [ 51619, "D8 4" ], [ 53555, "D8 X" ], [ 54195, "D9 L" ], [ 58526, "PQPW" ], [ 58629, "QWQP" ], [ 59827, "4SVW" ], [ 66623, "VPWQ" ], [ 78259, "LSVW" ], [ 83714, "D0 L" ], [ 85266, "D0 4" ], [ 87026, "D0 X" ], [ 109414, "W9QH" ], [ 109457, "QL9QHW" ], [ 130565, "6RPQV" ], [ 141407, "RPVQ" ], [ 147632, "T003" ], [ 160846, "SPSR" ], [ 175406, "wide", "BĀāāāāāā" ], [ 178259, "QSVW" ], [ 178485, "f91t" ], [ 179141, "PWRS" ], [ 185784, "SPRQ" ], [ 185819, "PQWV" ], [ 187209, "PQVS" ], [ 197527, "PQRV" ], [ 205753, "GTPS" ], [ 224292, "WSRP" ], [ 232005, "BRPQ" ], [ 235264, "QPWP" ], [ 235946, "GWRP" ], [ 245045, "SQRV" ], [ 252834, "4HVP" ], [ 253486, "PWRQ" ], [ 258711, "WPRQ" ], [ 264976, "PRWQ" ], [ 282668, "CPPW" ], [ 295808, "PQSV" ], [ 307783, "C8WP" ], [ 339121, "RPSQ" ], [ 357185, "FPVWS" ], [ 357410, "RUQP" ], [ 360005, "9QPW" ], [ 365454, "SWRV" ], [ 372977, "RVRP" ], [ 383874, "KTQP" ], [ 392107, "VWSU" ], [ 399176, "PQPR" ], [ 400678, "T0H3" ], [ 404523, "PQPV" ], [ 404970, "t39u" ], [ 405292, "RPRQ" ], [ 405876, "QPQR" ], [ 405920, "VRSQP" ], [ 406176, "VQSPR" ], [ 413617, "WSWP" ], [ 414851, "PRPQ" ], [ 415976, "PRPV" ], [ 416065, "VPVR" ], [ 416567, "QPQV" ], [ 419283, "TSVW" ], [ 420771, "HSVW" ], [ 421167, "SWVW" ], [ 422401, "QWPR" ], [ 424547, "PRPW" ], [ 463187, "PQPS" ], [ 472511, "L90I" ], [ 492195, "XSVW" ], [ 492385, "SPSW" ], [ 492940, "SVW3" ], [ 502802, "L18RS" ], [ 518951, "Genu" ], [ 519131, "Authu" ], [ 519154, "Hygo" ], [ 519334, "Cent" ], [ 519346, "auls" ], [ 528403, "RWQSV" ], [ 533886, "QQVW" ], [ 536987, "VWPV" ], [ 540009, "QQSVW" ], [ 540427, "QSV3" ], [ 542150, "QQQPQ" ], [ 544996, "WWVSW" ], [ 579239, "PQVR" ], [ 579527, "HPQVR" ], [ 593677, "f90t" ], [ 595997, "3PRW" ], [ 606754, "AHPQVR" ], [ 616144, "WVS3" ], [ 618119, "5ntel" ], [ 640557, "QQS3" ], [ 643341, "QVW3" ], [ 655657, "QQSV" ], [ 657902, "NHB3" ], [ 667970, "Ytlj" ], [ 669432, "9vdu" ], [ 699963, "CHW3" ], [ 706317, "PQRW" ], [ 707413, "QQSW" ], [ 710726, "8RCC" ], [ 710734, "8MOC" ], [ 720798, "tJ\u003c_t\u003c\u003c$t8\u003c\u003ct4\u003c\u003et0\u003c-t,\u003ca|" ], [ 727365, "Mwmh" ], [ 743084, "YYPV" ], [ 744938, "r49z" ], [ 746512, "UVWS" ], [ 747856, "UQPXY]Y[" ], [ 753105, "VWSP" ], [ 758525, "F8SP" ], [ 760050, "PSWSS" ], [ 765378, "f90u" ], [ 765393, "PVSQSWV" ], [ 775633, "PVWS" ], [ 776150, "SVW8A" ], [ 782923, "w9r0" ], [ 790517, "9p t" ], [ 791928, "9q j" ], [ 792547, "QQWPQ" ], [ 792567, "QQQWPQ" ], [ 797578, "PWWS" ], [ 802664, "f97t" ], [ 823550, "RVSW" ], [ 825834, "v6j0" ], [ 827071, "QWPV" ], [ 829415, "PPPPPWS" ], [ 829473, "QQQP" ], [ 829631, "PP9E u:PPVWP" ], [ 831851, "WSVPP" ], [ 837099, "9E WW" ], [ 846554, "WWWPWS" ], [ 847537, "f92t" ], [ 848378, "/PjSW" ], [ 855926, "f98t" ], [ 868295, "PPPV" ], [ 877408, "WVU3" ], [ 932720, "E:\\crypto-locker\\tpls_MSVC\\include\\boost-1_68\\boost/exception/detail/exception_ptr.hpp" ], [ 932808, "class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object\u003cstruct boost::exception_detail::bad_allo" ], [ 932992, "class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object\u003cstruct boost::exception_detail::bad_exce" ], [ 933160, "Clone() is not implemented yet." ], [ 933192, "unknown" ], [ 933216, "bad exception" ], [ 933284, "Unknown exception" ], [ 933316, "bad allocation" ], [ 933452, "bad cast" ], [ 933476, "bad locale name" ], [ 933492, "false" ], [ 933500, "true" ], [ 933744, "generic" ], [ 933780, "iostream" ], [ 933792, "iostream stream error" ], [ 933844, "system" ], [ 933852, "unknown error" ], [ 933888, "ios_base::badbit set" ], [ 933912, "ios_base::failbit set" ], [ 933936, "ios_base::eofbit set" ], [ 934304, "WinApi FormatMessage returned error" ], [ 934352, "boost::interprocess_exception::library_error" ], [ 934448, "tr1::bad_weak_ptr" ], [ 934784, "GetSystemDirectory() failed" ], [ 934812, "cmd.exe" ], [ 934868, "boost::thread_resource_error" ], [ 934928, "boost thread: trying joining itself" ], [ 935220, "call to empty boost::function" ], [ 935360, "directory_iterator::operator++" ], [ 935392, "exists" ], [ 935400, "file_size" ], [ 935412, "resize_file" ], [ 935424, "space" ], [ 935432, "permissions" ], [ 935444, "temp_directory_path" ], [ 935476, "Conversion failed" ], [ 935532, "option" ], [ 935608, "boost::bad_any_cast: failed conversion using boost::any_cast" ], [ 935688, "bad lexical cast: source type value could not be interpreted as target" ], [ 935884, "', trying to retrieve '" ], [ 935908, "', stored '" ], [ 935920, "NameValuePairs: type mismatch for '" ], [ 935956, ": this object doesn't support resynchronization" ], [ 936004, "RandomNumberGenerator: IncorporateEntropy not implemented" ], [ 936064, "BufferedTransformation: this object is not attachable" ], [ 936132, "CryptoMaterial: this object contains invalid values" ], [ 936184, "CryptoMaterial: this object does not support precomputation" ], [ 936252, "FeedbackSize" ], [ 936268, "InputBuffer" ], [ 936280, "OutputFileName" ], [ 936296, "OutputBinaryMode" ], [ 936316, "EncodingParameters" ], [ 936348, "DecodingLookupArray" ], [ 936396, "\" not used" ], [ 936408, "AlgorithmParametersBase: parameter \"" ], [ 936496, "CipherModeBase: feedback size cannot be specified for this cipher mode" ], [ 937440, "RandomNumberStore: CopyRangeTo2() is not supported by this store" ], [ 938088, "MGF1" ], [ 938992, "wide", "Greetings!\n\nThere was a significant flaw in the security system of your company.\nYou should be thankful that the flaw was exploi" ], [ 941952, "wide", "writing readme" ], [ 941984, "README-NOW.txt" ], [ 942068, "wide", "unknown exception:" ], [ 942212, "wide", "encrypting:" ], [ 942240, "wide", "encrypting!" ], [ 942280, "wide", "unknown exceptoion" ], [ 942324, "wide", "wiping free space" ], [ 942364, "wipe" ], [ 942372, "wide", "generating random data..." ], [ 942424, "wide", "generating random data...done" ], [ 942520, "wide", "unknown exception" ], [ 942648, "wide", "|.*\\\\(readme-now\\.txt|(ntuser|usrclass)\\.(dat|ini)|desktop\\.ini|.+\\.(lnk|sys|dll|locked)|microsoft\\\\windows\\\\burn|gdipfontcachev" ], [ 942972, ".lnk" ], [ 943000, "wide", "finished" ], [ 943020, "wide", "unhandled exception" ], [ 943060, ".locked" ], [ 943072, "wide", "\\.(doc|dot|wbk|docx|dotx|docb|xlm|xlsx|xltx|xlsb|xlw|ppt|pot|pps|pptx|potx|ppsx|sldx|pdf)" ], [ 943360, ".1200" ], [ 943480, "Allowed options" ], [ 943496, "produce help message" ], [ 943528, "print version" ], [ 943556, "create log" ], [ 943576, "dry run" ], [ 943592, "worker" ], [ 943612, "input file" ], [ 943632, "parallel jobs" ], [ 943656, "files to erase" ], [ 943680, "file" ], [ 943688, ".exe" ], [ 943712, "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xb" ], [ 943934, "wide", "y finised" ], [ 943964, "cl.log" ], [ 943984, "Unflushable\u003cT\u003e: this object has buffered input that cannot be flushed" ], [ 944072, "boost unique_lock has no mutex" ], [ 944104, "boost unique_lock doesn't own the mutex" ], [ 944144, "boost unique_lock owns already the mutex" ], [ 944340, "BufferedTransformation: this object doesn't allow input" ], [ 944396, "ReadFile failed" ], [ 944456, "AllocatorBase: requested size would cause integer overflow" ], [ 944516, "get_next_capacity, allocator's max size reached" ], [ 944564, "vector\u003cT\u003e too long" ], [ 944584, "WriteFile failed" ], [ 944604, "CreatePipe() failed" ], [ 944624, "vector\u003cbool\u003e too long" ] ], "sz": 1267728, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: COMODO RSA Code Signing CA", "e": [ "COMODO RSA Code Signing CA" ], "i": "metadata/signed/developer::comodo-rsa-code-signing-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: MIKL LIMITED", "e": [ "MIKL LIMITED" ], "i": "metadata/signed/developer::mikl-limited", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: COMODO RSA Certification Authority", "e": [ "COMODO RSA Certification Authority" ], "i": "metadata/signed/developer::comodo-rsa-certification-authority", "l": 2 }, { "c": 1.0, "d": "Signed by MIKL LIMITED", "e": [ "MIKL LIMITED" ], "i": "metadata/signed/leaf::mikl-limited", "l": 3 }, { "c": 0.800000011920929, "d": "Resolve special folder path via Shell32", "e": [ "SHGetFolderPathW" ], "i": "micro-behaviors/fs/shell-ops::shell-get-folder-path", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 166.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Cert chain has only 2 entries", "e": [ "pe.cert_chain_depth = 2.00" ], "i": "metadata/signed::pe-cert-shallow-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1497.003", "c": 0.699999988079071, "d": "QueryPerformanceFrequency timing", "e": [ "QueryPerformanceFrequency" ], "i": "micro-behaviors/time/timing/check::query-performance-frequency", "l": 2, "m": "B0003.003" }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "unknown command line syntax error for '%s'", "too many positional options have been specified on the command line", ".?AVinvalid_command_line_syntax@program_options@boost@@", "…_info_injector@Vinvalid_command_line_syntax@program_opt…" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 4067.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ ".?AU?$task_shared_state@V?$_Binder@U_Unforced@std@@AAV\u003clambda_8a7570b976bc101d83292d43f9603e9c\u003e@@HI@std@@X@detail@boost@@", ".?AV?$enable_shared_from_this@Ushared_state_base@detail@boost@@@boost@@", ".?AUshared_state_base@detail@boost@@", ".?AU?$task_base_shared_state@X@detail@boost@@", ".?AV?$sp_counted_impl_p@U?$task_shared_state@V?$_Binder@U_Unforced@std@@AAV\u003clambda_8a7570b976bc101d83292d43f9603e9c\u003e@@HI@std@@X@", ".?AU?$shared_state@X@detail@boost@@" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-6", "l": 1, "m": "C0027" }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.800000011920929, "d": "Revert WoW64 filesystem redirection", "e": [ "Wow64RevertWow64FsRedirection" ], "i": "micro-behaviors/os/compat/wow64::wow64-revert-redirect", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 3 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 0.9800000190734863, "d": "Regex component marker", "e": [ "binary.func_count = 4067.00" ], "i": "micro-behaviors/process/terminate/kill::toolhelp-kill-loop-source-cond-6--inline-3846", "l": 1 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcess failed", "CreateProcessW" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "already connected", "not connected" ], "i": "micro-behaviors/communications/http/llm::gpt-proxy-websocket-upstream--rx-13", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "LocalContextCacheSize", "|.*\\\\(readme-now\\.txt|(ntuser|usrclass)\\.(dat|ini)|desktop\\.ini|.+\\.(lnk|sys|dll|locked)|microsoft\\\\windows\\\\burn|gdipfontcachev", ".?AVCacheLocalScheduleGroupSegment@details@Concurrency@@", ".?AVCacheLocalScheduleGroup@details@Concurrency@@" ], "i": "objectives/command-and-control/dropper/staging::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StreamTransformationFilter: ciphertext length is not a multiple of block size", ".?AVInvalidCiphertext@CryptoPP@@" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-1", "l": 1, "m": "C0027" }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA", "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2 }, { "a": "T1486", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "Greetings!\n\nThere was a significant flaw in the security system of your company.\nYou should be thankful that the flaw was exploi", "encrypting:", "encrypting!", ": this key is too short to encrypt any messages" ], "i": "objectives/impact/ransom/encrypt/hybrid::rust-ransomware-module-set--rx-4", "l": 1, "m": "B0040" }, { "c": 0.8500000238418579, "d": "Open named event object", "e": [ "OpenEventA" ], "i": "micro-behaviors/process/sync/event::open-event", "l": 2, "m": "C0039" }, { "a": "T1486", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ ".?AV?$TF_ObjectImplBase@VTF_EncryptorBase@CryptoPP@@U?$TF_CryptoSchemeOptions@V?$TF_ES@URSA@CryptoPP@@V?$OAEP@VSHA1@CryptoPP@@VP", ".?AV?$AlgorithmImpl@VTF_EncryptorBase@CryptoPP@@V?$TF_ES@URSA@CryptoPP@@V?$OAEP@VSHA1@CryptoPP@@VP1363_MGF1@2@@2@H@2@@CryptoPP@@", "void __thiscall boost::concurrent::detail::sync_queue_base\u003cstruct crypto_locker::path_entry,class boost::detail::priority_queue\u003c", "E:\\crypto-locker\\cryptopp\\src\\sse_simd.cpp", "E:\\crypto-locker\\cryptopp\\src\\sha_simd.cpp", "E:\\crypto-locker\\cryptopp\\src\\rijndael_simd.cpp", ".?AV?$TF_CryptoSystemBase@VPK_Encryptor@CryptoPP@@V?$TF_Base@VRandomizedTrapdoorFunction@CryptoPP@@VPK_EncryptionMessageEncoding", ".?AV?$TF_EncryptorImpl@U?$TF_CryptoSchemeOptions@V?$TF_ES@URSA@CryptoPP@@V?$OAEP@VSHA1@CryptoPP@@VP1363_MGF1@2@@2@H@CryptoPP@@UR", "E:\\crypto-locker\\cryptopp\\src\\crc_simd.cpp", ".?AVPK_Encryptor@CryptoPP@@", ".?AVTF_EncryptorBase@CryptoPP@@", ".?AV?$PK_FixedLengthCryptoSystemImpl@VPK_Encryptor@CryptoPP@@@CryptoPP@@", "E:\\crypto-locker\\tpls_MSVC\\include\\boost-1_68\\boost/exception/detail/exception_ptr.hpp", "Greetings!\n\nThere was a significant flaw in the security system of your company.\nYou should be thankful that the flaw was exploi", ".?AV?$TF_ObjectImpl@VTF_EncryptorBase@CryptoPP@@U?$TF_CryptoSchemeOptions@V?$TF_ES@URSA@CryptoPP@@V?$OAEP@VSHA1@CryptoPP@@VP1363", "E:\\crypto-locker\\tpls_MSVC\\include\\boost-1_68\\boost/thread/concurrent_queues/detail/sync_queue_base.hpp" ], "i": "objectives/impact/ransom/encrypt/hybrid::rust-ransomware-module-set--rx-5", "l": 1, "m": "B0040" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Query drive type by symbol", "e": [ "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.9700000286102295, "d": "Signed PE wrapper marker", "e": [ "pe.has_signature = 1.00" ], "i": "metadata/binary/layout::signed-pe-wrapper", "l": 1 }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-dialogbox-l1-1-0", "ext-ms-win-kernel32-package-current-l1-1-0", "ext-ms-win-ntuser-windowstation-l1-1-0" ], "i": "metadata/binary/linking::api-set-ext-cluster", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (Unicode)", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w", "l": 3 }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-file-l2-1-1", "api-ms-win-core-localization-l1-2-1" ], "i": "metadata/binary/linking::api-set-core-cluster", "l": 1 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceExW" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1795.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004" }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales-import", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 4067.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "Too many links", "too many links" ], "i": "objectives/evasion/process::exe-in-media-folder--rx-6", "l": 1 }, { "c": 0.8999999761581421, "d": "Query timezone configuration", "e": [ "GetTimeZoneInformation" ], "i": "micro-behaviors/time/query::get-timezone-information", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "a": "T1567.002", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ": this object doesn't support resynchronization", "void __thiscall boost::concurrent::detail::sync_queue_base\u003cstruct crypto_locker::path_entry,class boost::detail::priority_queue\u003c", ".?AV?$clone_impl@U?$error_info_injector@Usync_queue_is_closed@concurrent@boost@@@exception_detail@boost@@@exception_detail@boost", ".?AU?$error_info_injector@Usync_queue_is_closed@concurrent@boost@@@exception_detail@boost@@", "E:\\crypto-locker\\tpls_MSVC\\include\\boost-1_68\\boost/thread/concurrent_queues/detail/sync_queue_base.hpp", "void __thiscall boost::concurrent::detail::sync_queue_base\u003cclass boost::detail::nullary_function\u003cvoid __cdecl(void)\u003e,class boost", "api-ms-win-core-synch-l1-2-0", ".?AUsync_queue_is_closed@concurrent@boost@@" ], "i": "well-known/tool/dual-use/megacmd::megacmd-binary-name--rx-5", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.75" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "a": "T1486", "c": 0.699999988079071, "d": "ProtonMail contact address", "e": [ "AbbsChevis@protonmail.com" ], "i": "objectives/impact/ransom/native::protonmail-contact", "l": 3, "m": "C0027" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "FreeEnvironmentStringsW", "GetStringTypeW", "\u003cunrepresentable unicode string\u003e", "string too long", "LCMapStringW", "GetEnvironmentStringsW", "StringNarrow: wcstombs_s() call failed with error", "api-ms-win-core-string-l1-1-0", "boost::filesystem::path codecvt to wstring", "CompareStringEx", ".?AV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@s", "invalid string position", "StringStore: missing InputBuffer argument", "LCMapStringEx", "GetLogicalDriveStringsW", "CompareStringW" ], "i": "micro-behaviors/communications/http/client::webclient--rx-7", "l": 1 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "too many links", "Too many links" ], "i": "objectives/evasion/masquerade/file/suspicious-path::exe-in-media-folder--rx-6", "l": 1 }, { "c": 0.9900000095367432, "d": "MSVC C++ runtime strerror diagnostic string", "e": [ "Visual C++ CRT: Not enough memory to complete call to strerror." ], "i": "objectives/evasion/process/injection::msvc-crt-strerror-string", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll", "advapi32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.38" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1486", "c": 0.699999988079071, "d": "Regex component marker", "e": [ "README-NOW.txt" ], "i": "objectives/impact/ransom/native::readme-note-file--rx-1", "l": 1, "m": "C0027" }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "a": "T1547.001", "c": 0.800000011920929, "d": "Filters files by .lnk extension", "e": [ ".lnk" ], "i": "objectives/persistence/login/startup/shortcut::lnk-endswith-filter", "l": 1 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool", "thread_pool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Acquire cryptographic service provider context", "e": [ "CryptAcquireContextA" ], "i": "micro-behaviors/crypto/library::crypt-acquire-context", "l": 3, "m": "C0027" }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ ".?AV?$ASN1CryptoMaterial@VPublicKey@CryptoPP@@@CryptoPP@@", "PublicExponent", ".?AVPublicKey@CryptoPP@@", "for this public key", "spanish-dominican republic", ".?AVX509PublicKey@CryptoPP@@", ".?AVPublicKeyAlgorithm@CryptoPP@@" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1106", "c": 0.8500000238418579, "d": "CreateProcessW API string", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w-string", "l": 3 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.8999999761581421, "d": "DeleteTimerQueueTimer symbol", "e": [ "DeleteTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback::delete-timer-queue-timer-sym", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "CloseHandle", "NtClose", "CloseThreadpoolWait", "CloseThreadpoolTimer", "FindClose", "void __thiscall boost::concurrent::detail::sync_queue_base\u003cstruct crypto_locker::path_entry,class boost::detail::priority_queue\u003c", "void __thiscall boost::concurrent::detail::sync_queue_base\u003cclass boost::detail::nullary_function\u003cvoid __cdecl(void)\u003e,class boost", "CloseThreadpoolWork", ".?AUsync_queue_is_closed@concurrent@boost@@", ".?AV?$clone_impl@U?$error_info_injector@Usync_queue_is_closed@concurrent@boost@@@exception_detail@boost@@@exception_detail@boost", ".?AU?$error_info_injector@Usync_queue_is_closed@concurrent@boost@@@exception_detail@boost@@" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 3 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.75, "d": "Ransomware tool marker", "e": [ "Your files are encrypted" ], "i": "objectives/impact/ransom/markers::ransomware-banner-core", "l": 4 }, { "a": "T1102", "c": 0.7200000286102295, "d": "EVM function selector literal", "e": [ "0x50b61c8d" ], "i": "objectives/command-and-control/infrastructure/blockchain/polygon::evm-selector-hex-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Native runtime has many functions", "e": [ "binary.func_count = 4067.00" ], "i": "metadata/lang/compiler/aot::huge-runtime-function-count", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1795.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "d": "\"your files\" ransom phrase", "e": [ "Your files are" ], "i": "micro-behaviors/data/text/malware::your-files-phrase", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "File API ANSI check", "e": [ "AreFileApisANSI" ], "i": "micro-behaviors/os/env/access::are-file-apis-ansi", "l": 2 }, { "c": 0.800000011920929, "d": "Initialize security descriptor", "e": [ "InitializeSecurityDescriptor" ], "i": "micro-behaviors/os/security/descriptor::initialize-security-descriptor", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Input/output error", "FileSink: output stream not opened" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ ".?AVResourceManager@details@Concurrency@@", ".?AUIResourceManager@Concurrency@@" ], "i": "micro-behaviors/data/embedded/payload::dotnet-resource-manager-token", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.6000000238418579, "d": "\"pay...bitcoin\" ransom phrase", "e": [ "payment has to be made in Bitcoin" ], "i": "micro-behaviors/data/text/malware::pay-bitcoin-phrase", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.63)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 4067.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "a": "T1574", "c": 0.8999999761581421, "d": "Disable WoW64 filesystem redirection", "e": [ "Wow64DisableWow64FsRedirection" ], "i": "micro-behaviors/os/compat/wow64::wow64-disable-redirect", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "a": "T1070.004", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "CreateFileMappingA", "wiping free space" ], "i": "objectives/evasion/self-delete/file::ping-self-delete--rx-2", "l": 1 }, { "d": "overflow keyword", "e": [ "…_std_exception_wrapper@Voverflow_error@std@@@exception_d…", ".?AVoverflow_error@std@@", "AllocatorBase: requested size would cause integer overflow", "RoundUpToMultipleOf: integer overflow" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::get-user-default-lcid", "l": 2 }, { "c": 0.8799999952316284, "d": "Overlay manifest requires administrator", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator-overlay", "l": 3 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceExW" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.49" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "a": "T1573", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ ".?AU?$task_shared_state@V?$_Binder@U_Unforced@std@@AAV\u003clambda_8a7570b976bc101d83292d43f9603e9c\u003e@@HI@std@@X@detail@boost@@", ".?AU?$task_base_shared_state@X@detail@boost@@", ".?AV?$sp_counted_impl_p@U?$task_shared_state@V?$_Binder@U_Unforced@std@@AAV\u003clambda_8a7570b976bc101d83292d43f9603e9c\u003e@@HI@std@@X@", ".?AV?$enable_shared_from_this@Ushared_state_base@detail@boost@@@boost@@", ".?AU?$shared_state@X@detail@boost@@", ".?AUshared_state_base@detail@boost@@" ], "i": "micro-behaviors/crypto/asymmetric/kem::kyber-encapsulation-terms--rx-5", "l": 1, "m": "C0027" }, { "c": 0.4000000059604645, "d": "cipher keyword", "e": [ "cipher" ], "i": "micro-behaviors/crypto/library::cipher-keyword", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.func_count = 4067.00" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute-cond-4--inline-11988", "l": 1 }, { "c": 0.8999999761581421, "d": "Set security descriptor DACL", "e": [ "SetSecurityDescriptorDacl" ], "i": "micro-behaviors/os/security/descriptor::set-security-descriptor-dacl", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically push entry to thread-safe list", "e": [ "InterlockedPushEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-push-entry-slist", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (word match)", "e": [ "crypto" ], "i": "micro-behaviors/data/text/keywords::crypto-word", "l": 1 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "UnmapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 36308.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection::enum-locale-callback", "l": 3, "m": "E1106" }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8999999761581421, "d": "Atomically pop entry from thread-safe list", "e": [ "InterlockedPopEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-pop-entry-slist", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically flush thread-safe list", "e": [ "InterlockedFlushSList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-flush-slist", "l": 2 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesW", "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "a": "T1486", "c": 0.9200000166893005, "d": "READ_ME_NOW ransom note", "e": [ "README-NOW.txt" ], "i": "objectives/impact/ransom/encrypt/hybrid::ransom-note-read-me-now", "l": 4, "m": "B0040" }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.949999988079071, "d": "Ransom note message patterns", "e": [ "Your files are encrypted" ], "i": "objectives/impact/ransom/encrypt::ransom-note-text", "l": 4 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Enumerate logical drive strings", "e": [ "GetLogicalDriveStringsW" ], "i": "micro-behaviors/fs/traversal/drives::get-logical-drive-strings", "l": 3, "m": "E1083" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1559", "c": 0.8999999761581421, "d": "Create anonymous pipe", "e": [ "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::create-pipe", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "a": "T1204.002", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "create log", "CreateSymbolicLinkW", "CreateFileMappingA", "CreateEventA", "CreateSemaphoreA", "CreateSemaphoreW", "CreateProcessW", "CreatePipe", "CreateThreadpoolTimer", "CreateThreadpoolWork", "CreatePipe() failed", "CreateEventExW", "CreateFileA", "CreateProcess failed", "CreateSemaphoreExW", "CreateThreadpoolWait" ], "i": "objectives/command-and-control/dropper/execution/clickfix::schtasks-remote-unc-xml--rx-3", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "E:\\crypto-locker\\cryptopp\\src\\sse_simd.cpp", "E:\\crypto-locker\\tpls_MSVC\\include\\boost-1_68\\boost/exception/detail/exception_ptr.hpp", "…struct std::less\u003cstruct crypto_locker::path_entry\u003e \u003e \u003e…", "…:sync_queue_base\u003cstruct crypto_locker::path_entry,clas…", "…ontainer::vector\u003cstruct crypto_locker::path_entry,clas…", "E:\\crypto-locker\\cryptopp\\src\\crc_simd.cpp", "…::priority_queue\u003cstruct crypto_locker::path_entry,clas…", "…re as Photorec, RannohDecryptor etc.\nwill lead to irre…", "E:\\crypto-locker\\cryptopp\\src\\rijndael_simd.cpp", "E:\\crypto-locker\\cryptopp\\src\\sha_simd.cpp", "…r::new_allocator\u003cstruct crypto_locker::path_entry\u003e,voi…", "E:\\crypto-locker\\tpls_MSVC\\includ…" ], "i": "micro-behaviors/data/text/keywords::crypto-substr", "l": 1 }, { "c": 0.9700000286102295, "d": "Host Process for Windows Services", "e": [ "Host Process for Windows Services" ], "i": "objectives/evasion/masquerade/version-resource/service-host::host-process-service-description", "l": 1 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreA" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with many wide strings", "e": [ "binary.wide_string_count = 263.00" ], "i": "objectives/anti-static/obfuscation/payload/section::heavy-wide-string-corpus", "l": 1, "m": "B0032" }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Release cryptographic context", "e": [ "CryptReleaseContext" ], "i": "micro-behaviors/crypto/library::crypt-release-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "c": 0.800000011920929, "d": "cmd.exe command interpreter reference", "e": [ "cmd.exe" ], "i": "micro-behaviors/process/create/exec::cmd-exe-reference", "l": 3 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "encrypt" ], "i": "micro-behaviors/crypto/library::encrypt-fn", "l": 3 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.800000011920929, "d": "Query file attributes and timestamps", "e": [ "GetFileAttributesExW" ], "i": "micro-behaviors/fs/file/timestamp::get-file-attributes-ex", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1573", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ ".?AVInvalidCiphertext@CryptoPP@@", "StreamTransformationFilter: ciphertext length is not a multiple of block size" ], "i": "micro-behaviors/crypto/asymmetric/kem::kyber-encapsulation-terms--rx-1", "l": 1, "m": "C0027" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1548433841.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 166.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.75, "d": "CreateTimerQueue import (rare, common padding symbol)", "e": [ "CreateTimerQueue" ], "i": "metadata/binary/anomaly::import-padding-timer-queue", "l": 1 }, { "c": 0.8500000238418579, "d": "Wait on multiple handles extended", "e": [ "WaitForMultipleObjectsEx" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects-ex", "l": 2, "m": "C0042" }, { "d": "POSIX \"Permission denied\" error message", "e": [ "Permission denied" ], "i": "micro-behaviors/os/message/error::permission-denied", "l": 2 }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE TLS callback table present", "e": [ "pe.tls_callbacks = 1.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-callbacks-metric", "l": 1 }, { "c": 0.800000011920929, "d": "Auto-elevation manifest attribute", "e": [ "\u003cautoElevate\u003etrue" ], "i": "micro-behaviors/os/privilege/manifest::auto-elevate", "l": 4 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 166.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "CreateTimerQueueTimer symbol", "e": [ "CreateTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback::create-timer-queue-timer-sym", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "PathIsNetworkPathA", "SHGetFolderPathW", "GetTempPathW" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script::cmd-exe-dup", "l": 1 }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 33088.00" ], "i": "metadata/hardening::no-aslr-bit", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "One .text section dominates file", "e": [ "binary.text_to_file_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::text-heavy-binary", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1055.012", "c": 0.6000000238418579, "d": "ResumeThread call", "e": [ "ResumeThread" ], "i": "objectives/evasion/process/injection/hollowing::resume-thread", "l": 1, "m": "E1055.012" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 166.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.func_count = 4067.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "Wkernel32.dll", "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "ntdll.dll" ], "i": "objectives/evasion/anti-av/platform::ntdll-dll-str", "l": 1 }, { "c": 0.8799999952316284, "d": "Configure waitable timer", "e": [ "SetWaitableTimer" ], "i": "micro-behaviors/time/schedule/waitable::set-waitable-timer", "l": 3 }, { "c": 0.8999999761581421, "d": "Set thread CPU affinity", "e": [ "SetThreadAffinityMask" ], "i": "micro-behaviors/process/control/affinity::set-thread-affinity-mask", "l": 3 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Generate cryptographic random bytes", "e": [ "CryptGenRandom" ], "i": "micro-behaviors/os/random/generator::crypt-gen-random", "l": 2, "m": "C0027" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "FilterWithBufferedInput", "AuthenticatedEncryptionFilter", "MontgomeryRepresentation", "QueryPerformanceFrequency", "AlgorithmParametersBase", "InitializeCriticalSectionEx", "TruncatedDigestSize", "RandomNumberGenerator", "RoundUpToMultipleOf", "GetFileInformationByHandleEx", "WaitForThreadpoolTimerCallbacks", "GetSystemDirectory", "RandomNumberGeneratorPointer", "RandomNumberStoreSize" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.func_count = 4067.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1795.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "FNV-1a 32-bit prime constant (0x01000193)", "e": [ "93 01 00 01" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-32bit-literal", "l": 1, "m": "B0032.014" }, { "a": "T1055", "c": 0.8999999761581421, "d": "ResumeThread API reference", "e": [ "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime::resume-thread-dup", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1027.007", "c": 1.0, "d": "ntdll.dll as wide string (runtime resolver)", "e": [ "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::ntdll-wide-string", "l": 1, "m": "B0032.014" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 4067.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{C15730E2-145C-4c5e-B005-3BC753F42475}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "c": 0.949999988079071, "d": "XORed Cobalt Strike config marker", "e": [ "EF BE [2] BE B7" ], "i": "well-known/malware/rat/cobalt-strike::xored-config-beef-rdata", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1091", "c": 0.8799999952316284, "d": "Windows drive type query", "e": [ "GetDriveTypeW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-drive-type-w", "l": 1, "m": "B0017" }, { "a": "T1091", "c": 0.8600000143051147, "d": "VB6 disk free space check GetDiskFreeSpaceExW", "e": [ "GetDiskFreeSpaceExW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-disk-free-space", "l": 1, "m": "B0017" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-4--inline-29205", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links ole32.dll (CoCreateInstance, CoUninitialize, CoInitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (CryptReleaseContext, CryptAcquireContextA, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, CryptGenRandom)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (PathIsNetworkPathA)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetFolderPathW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CloseHandle, DuplicateHandle, UnmapViewOfFile, CreateFileMappingA, MapViewOfFileEx, ... +151 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetModuleHandleW", "GetModuleHandleExW", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "MoveFileExW", "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "EnumSystemLocalesEx", "GetLocaleInfoW", "EnumSystemLocalesW", "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::locale-environment-fingerprint", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "CreateFileW", "SetFilePointerEx", "ReadFile", "GetModuleFileNameA", "CreateFileA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Pipe creation with handle redirect", "e": [ "SetStdHandle", "DuplicateHandle", "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::pipe-io-redirect", "l": 3 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 166.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "c": 0.8999999761581421, "d": "Timer queue create + delete lifecycle", "e": [ "CreateTimerQueueTimer", "DeleteTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback::timer-queue-lifecycle", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "EnumSystemLocalesW", "GetUserDefaultLCID", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::locale-fingerprinting-imports", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 2, "m": "F0007" }, { "c": 0.8500000238418579, "d": "Semaphore coordination with wait logic", "e": [ "WaitForMultipleObjectsEx", "CreateSemaphoreA", "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::coordinated-semaphore-wait", "l": 2, "m": "C0042" }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InterlockedPushEntrySList", "InitializeSListHead", "InterlockedPopEntrySList", "InterlockedFlushSList" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large binary with low average complexity", "e": [ "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77", "binary.string_count = 1795.00", "binary.avg_complexity = 5.75", "binary.overall_entropy = 5.49", "binary.func_count = 4067.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-binary-low-average-complexity", "l": 2, "m": "B0032" }, { "a": "T1548.002", "c": 0.8999999761581421, "d": "Auto-elevation without trusted signature", "e": [ "\u003cautoElevate\u003etrue" ], "i": "objectives/privilege-escalation/elevation-control/uac-bypass/manifest::unsigned-auto-elevate", "l": 4 }, { "a": "T1497.001", "c": 0.8500000238418579, "d": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "e": [ "GetSystemInfo", "GetDiskFreeSpaceExW", "GetTickCount" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::hardware-fingerprint-cluster", "l": 2, "m": "B0007" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "EnumSystemLocalesEx", "GetLocaleInfoW", "FreeEnvironmentStringsW", "EnumSystemLocalesW", "GetUserDefaultLCID", "GetEnvironmentStringsW" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "GetUserDefaultLCID", "GetCurrentThreadId", "GetLocaleInfoW", "EnumSystemLocalesW", "GetEnvironmentStringsW", "GetCommandLineA", "GetCommandLineW", "FreeEnvironmentStringsW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082" }, { "a": "T1204", "c": 0.8999999761581421, "d": "Self-mapping dropper extracts and executes payload", "e": [ "UnmapViewOfFile", "GetModuleFileNameW", "WriteFile", "GetModuleFileNameA", "CreateProcessW" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute", "l": 2 }, { "c": 0.8999999761581421, "d": "Query and modify CPU affinity", "e": [ "GetProcessAffinityMask", "SetThreadAffinityMask" ], "i": "micro-behaviors/process/control/affinity::affinity-mask-control", "l": 3 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Sparse-import evasive PE loader", "e": [ "binary.import_count = 166.00", "pe.api_hashing_indicators = 1.00", "binary.text_to_file_ratio = 0.73", "binary.behavioral_import_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::sparse-import-evasive-pe", "l": 3, "m": "B0032" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "EnumSystemLocalesW", "GetSystemTimeAsFileTime", "GetEnvironmentStringsW", "GetCommandLineW", "GetLocaleInfoW", "EnumSystemLocalesEx", "FreeEnvironmentStringsW", "GetUserDefaultLCID", "GetCommandLineA" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082" } ], "sha": "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77", "path": "6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77.zip!!6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77", "type": "pe" } ], "tv": "27ac5" } }