{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9997542500495911, "class": 2 } ], "prob": 0.99975425, "class": 2, "models": [ { "m": "az", "prob": 0.9995148, "class": 1 }, { "m": "az/native", "prob": 0.99975425, "class": 0 }, { "m": "az/pe", "prob": 0.99967515, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T10:28:26Z" }, "path": "64381", "raw": { "v": "4", "fs": [ { "f": "KO₈(As₈C₈Dy₂Er₉AlCo₂EuP)H₈(Cm₄F₃Os₂Po₅CrDb₂DsMg)Md₃(Bi₉He₂Si)", "k": { "pe.timestamp": 1243725792, "debug.pdb_path": "d:\\p4stg\\install\\install\\Monet\\Apps\\bin\\win64a\\b_rel\\installShell64.pdb", "hashes.imphash": "f6bca218e4add837a16519a7dc44c311", "pe.codeview_age": 1, "pe.codeview_guid": "DD55ECC9-260D-4612-A30C-5BD2523A815B", "build.target_arch": "x86_64", "pe.linker_version": "8.0", "pe.resource_types[0]": "RT_VERSION", "pe.rich_header.xor_key": "0xe68dc80d", "hashes.rich_header_hash": "230664d1fabb5ace221bb4eeb629fac7e438d995741e0de884c51e122dd7f8a8", "pe.debug_entries[0].size": 96, "pe.debug_entries[0].type": "codeview", "pe.debug_directory_types[0]": 2, "pe.version_info.company_name": "AMD", "pe.version_info.file_version": "1, 0, 0, 5", "pe.version_info.product_name": "installShell", "pe.debug_entries[0].timestamp": 1169049445, "pe.version_info.internal_name": "installS", "pe.version_info.legal_copyright": "Copyright (C) 2006", "pe.version_info.product_version": "1, 0, 0, 5", "pe.version_info.file_description": "installShell", "pe.version_info.original_filename": "installShell.exe", "pe.rich_header.entries[0].use_count": 8, "pe.rich_header.entries[1].use_count": 60, "pe.rich_header.entries[2].use_count": 145, "pe.rich_header.entries[3].use_count": 2, "pe.rich_header.entries[4].use_count": 11, "pe.rich_header.entries[5].use_count": 124, "pe.rich_header.entries[6].use_count": 3, "pe.rich_header.entries[7].use_count": 1, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[0].product_id": 125, "pe.rich_header.entries[1].product_id": 110, "pe.rich_header.entries[2].product_id": 109, "pe.rich_header.entries[3].product_id": 109, "pe.rich_header.entries[4].product_id": 123, "pe.rich_header.entries[5].product_id": 1, "pe.rich_header.entries[6].product_id": 114, "pe.rich_header.entries[7].product_id": 124, "pe.rich_header.entries[8].product_id": 120, "pe.rich_header.entries[0].build_number": 50727, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 50727, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 50727, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 40310, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].build_number": 40310, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[6].build_number": 50727, "pe.rich_header.entries[6].product_name": "unknown", "pe.rich_header.entries[7].build_number": 50727, "pe.rich_header.entries[7].product_name": "unknown", "pe.rich_header.entries[8].build_number": 50727, "pe.rich_header.entries[8].product_name": "Cvtres_VS2008", "pe.dll_characteristics.terminal_server_aware": true }, "x": 130, "id": 0, "is": [ "RegCreateKeyExW", "RegQueryInfoKeyW", "RegDeleteKeyW", "ConvertStringSecurityDescriptorToSecurityDescriptorW", "RegOpenKeyExW", "RegEnumKeyExW", "RegCloseKey", "RegSetValueExW", "FindFirstFileW", "FreeLibrary", "CreateProcessW", "LoadLibraryExW", "WaitForSingleObject", "GetSystemDirectoryW", "WideCharToMultiByte", "Sleep", "GetModuleFileNameW", "lstrlenW", "GetLastError", "GetProcAddress", "FindNextFileW", "CloseHandle", "GetWindowsDirectoryW", "DeleteFileW", "lstrcpyW", "SetEndOfFile", "CreateFileW", "CreateFileA", "GetLocaleInfoW", "ReadFile", "SetStdHandle", "WriteConsoleW", "GetConsoleOutputCP", "WriteConsoleA", "MultiByteToWideChar", "InitializeCriticalSection", "DeleteCriticalSection", "EnterCriticalSection", "LeaveCriticalSection", "HeapFree", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlCaptureContext", "GetVersionExA", "HeapAlloc", "GetProcessHeap", "GetStartupInfoW", "GetCPInfo", "RtlLookupFunctionEntry", "RtlUnwindEx", "RaiseException", "RtlPcToFileHeader", "LCMapStringA", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "GetModuleHandleA", "ExitProcess", "RtlVirtualUnwind", "HeapSetInformation", "HeapCreate", "FlsGetValue", "FlsSetValue", "TlsFree", "FlsFree", "SetLastError", "GetCurrentThreadId", "FlsAlloc", "SetHandleCount", "GetStdHandle", "GetFileType", "GetStartupInfoA", "WriteFile", "GetConsoleCP", "GetConsoleMode", "FlushFileBuffers", "HeapSize", "SetFilePointer", "GetModuleFileNameA", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetCommandLineA", "GetCommandLineW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "GetACP", "GetOEMCP", "GetUserDefaultLCID", "GetLocaleInfoA", "EnumSystemLocalesA", "IsValidLocale", "IsValidCodePage", "HeapReAlloc", "LoadLibraryA", "MessageBoxW", "SHFileOperationW", "SHGetFolderPathW", "SHGetSpecialFolderPathW", "OleUninitialize", "CoInitialize", "OleInitialize", "CoUninitialize", "CoCreateInstance" ], "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "pdb_path": "d:\\p4stg\\install\\install\\Monet\\Apps\\bin\\win64a\\b_rel\\installShell64.pdb", "rsrc_size": 28672.0, "subsystem": 2.0, "timestamp": 1243725792.0, "image_base": 4194304.0, "codeview_age": 1.0, "rsrc_entropy": 7.92, "codeview_guid": "DD55ECC9-260D-4612-A30C-5BD2523A815B", "entry_section": ".rsrc", "size_of_image": 409600.0, "timestamp_day": 30.0, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "timestamp_year": 2009.0, "characteristics": 35.0, "entry_point_rva": 401014.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 5.0, "computed_checksum": 432784.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1169049445.0, "debug_timestamp_min": 1169049445.0, "dll_characteristics": 32768.0, "rich_header_present": true, "linker_major_version": 8.0, "version_info_present": true, "debug_directory_types": [ 2.0 ], "api_hashing_indicators": 1.0, "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "entry_in_nonstandard_section": true, "debug_timestamp_nonzero_count": 1.0 }, "file": { "size": 384512.0 }, "binary": { "code_size": 260608.0, "func_count": 1328.0, "entry_point": 401014.0, "wx_sections": 1.0, "code_entropy": 7.07, "data_entropy": 4.38, "func_density": 5.22, "import_count": 110.0, "string_count": 864.0, "avg_func_size": 11.0, "section_count": 6.0, "avg_complexity": 2.0, "import_density": 0.43, "max_complexity": 2.0, "string_density": 3.39, "overall_entropy": 4.55, "avg_basic_blocks": 3.0, "avg_section_size": 63914.67, "dependency_count": 5.0, "entropy_variance": 2.5, "avg_string_length": 25.93, "complexity_per_kb": 0.01, "max_string_length": 244.0, "wide_string_count": 429.0, "writable_sections": 3.0, "avg_string_entropy": 3.42, "code_to_data_ratio": 2.12, "data_to_file_ratio": 0.05, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.07, "text_to_file_ratio": 0.6, "total_basic_blocks": 3.0, "executable_sections": 2.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 20.72, "debug_reference_count": 1.0, "largest_section_ratio": 0.6, "sentence_string_count": 266.0, "sentence_string_ratio": 0.31, "behavioral_import_ratio": 0.04, "entry_in_nonstandard_section": true, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 512, ".text" ], [ 591, "@.data" ], [ 632, ".pdata" ], [ 671, "@.rsrc" ], [ 712, "qpgueml" ], [ 6803, "gfffffffH" ], [ 6941, "gfffffffI" ], [ 11224, "X ff" ], [ 12480, "f92t" ], [ 15818, "L1HH" ], [ 18456, "gfffffffu" ], [ 30858, "gfffffff" ], [ 31419, "t.ff" ], [ 41379, "8H9Q" ], [ 44994, "D1XH" ], [ 45333, "L9HH" ], [ 45920, "D9XH" ], [ 46064, "L9HF" ], [ 50581, "SUVWH" ], [ 74216, "Y ff" ], [ 75153, "gfffffffM" ], [ 88475, "P ff" ], [ 93314, "C H9" ], [ 95371, "L9 H" ], [ 101122, "2333333" ], [ 114340, "t.fff" ], [ 114422, "u1fff" ], [ 116108, "f90t" ], [ 184748, "M0H3" ], [ 234472, "string too long" ], [ 234528, "invalid string position" ], [ 234728, "Unknown exception" ], [ 234992, "LC_TIME" ], [ 235000, "LC_NUMERIC" ], [ 235016, "LC_MONETARY" ], [ 235032, "LC_CTYPE" ], [ 235048, "LC_COLLATE" ], [ 235060, "LC_ALL" ], [ 235247, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 235400, "bad exception" ], [ 236194, "wide", "h(((( H" ], [ 236880, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 237264, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 237488, "CorExitProcess" ], [ 237504, "mscoree.dll" ], [ 237536, "wide", "(null)" ], [ 237552, "(null)" ], [ 237609, "700WP" ], [ 237625, "`h````" ], [ 237664, "EncodePointer" ], [ 237680, "KERNEL32.DLL" ], [ 237696, "DecodePointer" ], [ 237712, "runtime error" ], [ 237736, "TLOSS error" ], [ 237752, "SING error" ], [ 237768, "DOMAIN error" ], [ 237792, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 237799, "An application has made an attempt to load the C runtime library incorrectly." ], [ 237877, "Please contact the application's support team for more information." ], [ 237952, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 237959, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 238039, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 238200, "R6032\r\n- not enough space for locale information" ], [ 238207, "- not enough space for locale information" ], [ 238256, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 238263, "- Attempt to initialize the CRT more than once." ], [ 238311, "This indicates a bug in your application." ], [ 238360, "R6030\r\n- CRT not initialized" ], [ 238367, "- CRT not initialized" ], [ 238392, "R6028\r\n- unable to initialize heap" ], [ 238399, "- unable to initialize heap" ], [ 238432, "R6027\r\n- not enough space for lowio initialization" ], [ 238439, "- not enough space for lowio initialization" ], [ 238488, "R6026\r\n- not enough space for stdio initialization" ], [ 238495, "- not enough space for stdio initialization" ], [ 238544, "R6025\r\n- pure virtual function call" ], [ 238551, "- pure virtual function call" ], [ 238584, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 238591, "- not enough space for _onexit/atexit table" ], [ 238640, "R6019\r\n- unable to open console device" ], [ 238647, "- unable to open console device" ], [ 238688, "R6018\r\n- unexpected heap error" ], [ 238695, "- unexpected heap error" ], [ 238728, "R6017\r\n- unexpected multithread lock error" ], [ 238735, "- unexpected multithread lock error" ], [ 238776, "R6016\r\n- not enough space for thread data" ], [ 238783, "- not enough space for thread data" ], [ 238832, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 238834, "This application has requested the Runtime to terminate it in an unusual way." ], [ 238984, "R6009\r\n- not enough space for environment" ], [ 238991, "- not enough space for environment" ], [ 239032, "R6008\r\n- not enough space for arguments" ], [ 239039, "- not enough space for arguments" ], [ 239080, "R6002\r\n- floating point not loaded" ], [ 239087, "- floating point not loaded" ], [ 239120, "Microsoft Visual C++ Runtime Library" ], [ 239168, "\u003cprogram name unknown\u003e" ], [ 239192, "Runtime Error!\n\nProgram:" ], [ 239240, "dddd, MMMM dd, yyyy" ], [ 239264, "MM/dd/yy" ], [ 239288, "December" ], [ 239304, "November" ], [ 239320, "October" ], [ 239328, "September" ], [ 239340, "August" ], [ 239348, "July" ], [ 239356, "June" ], [ 239364, "April" ], [ 239372, "March" ], [ 239384, "February" ], [ 239400, "January" ], [ 239456, "Saturday" ], [ 239468, "Friday" ], [ 239480, "Thursday" ], [ 239496, "Wednesday" ], [ 239512, "Tuesday" ], [ 239520, "Monday" ], [ 239528, "Sunday" ], [ 239568, "united-states" ], [ 239584, "united-kingdom" ], [ 239600, "trinidad \u0026 tobago" ], [ 239624, "south-korea" ], [ 239640, "south-africa" ], [ 239656, "south korea" ], [ 239672, "south africa" ], [ 239688, "slovak" ], [ 239696, "puerto-rico" ], [ 239712, "pr-china" ], [ 239728, "pr china" ], [ 239744, "new-zealand" ], [ 239760, "hong-kong" ], [ 239776, "holland" ], [ 239784, "great britain" ], [ 239800, "england" ], [ 239816, "china" ], [ 239824, "britain" ], [ 239832, "america" ], [ 239864, "swedish-finland" ], [ 239880, "spanish-venezuela" ], [ 239904, "spanish-uruguay" ], [ 239920, "spanish-puerto rico" ], [ 239944, "spanish-peru" ], [ 239960, "spanish-paraguay" ], [ 239984, "spanish-panama" ], [ 240000, "spanish-nicaragua" ], [ 240024, "spanish-modern" ], [ 240040, "spanish-mexican" ], [ 240056, "spanish-honduras" ], [ 240080, "spanish-guatemala" ], [ 240104, "spanish-el salvador" ], [ 240128, "spanish-ecuador" ], [ 240144, "spanish-dominican republic" ], [ 240176, "spanish-costa rica" ], [ 240200, "spanish-colombia" ], [ 240224, "spanish-chile" ], [ 240240, "spanish-bolivia" ], [ 240256, "spanish-argentina" ], [ 240280, "portuguese-brazilian" ], [ 240304, "norwegian-nynorsk" ], [ 240328, "norwegian-bokmal" ], [ 240352, "norwegian" ], [ 240368, "italian-swiss" ], [ 240384, "irish-english" ], [ 240400, "german-swiss" ], [ 240416, "german-luxembourg" ], [ 240440, "german-lichtenstein" ], [ 240464, "german-austrian" ], [ 240480, "french-swiss" ], [ 240496, "french-luxembourg" ], [ 240520, "french-canadian" ], [ 240536, "french-belgian" ], [ 240552, "english-usa" ], [ 240568, "english-us" ], [ 240584, "english-uk" ], [ 240600, "english-trinidad y tobago" ], [ 240632, "english-south africa" ], [ 240656, "english-nz" ], [ 240672, "english-jamaica" ], [ 240688, "english-ire" ], [ 240704, "english-caribbean" ], [ 240728, "english-can" ], [ 240744, "english-belize" ], [ 240760, "english-aus" ], [ 240776, "english-american" ], [ 240800, "dutch-belgian" ], [ 240816, "chinese-traditional" ], [ 240840, "chinese-singapore" ], [ 240864, "chinese-simplified" ], [ 240888, "chinese-hongkong" ], [ 240912, "chinese" ], [ 240928, "canadian" ], [ 240944, "belgian" ], [ 240952, "australian" ], [ 240968, "american-english" ], [ 240992, "american english" ], [ 241016, "american" ], [ 242480, "Norwegian-Nynorsk" ], [ 242520, "UTF-16LE" ], [ 242536, "UNICODE" ], [ 242576, "wide", "UTF-16LE" ], [ 242600, "wide", "UNICODE" ], [ 242616, "InitializeCriticalSectionAndSpinCount" ], [ 242656, "kernel32.dll" ], [ 242718, "700PP" ], [ 242768, "Complete Object Locator'" ], [ 242800, "Class Hierarchy Descriptor'" ], [ 242832, "Base Class Array'" ], [ 242856, "Base Class Descriptor at (" ], [ 242888, "Type Descriptor'" ], [ 242912, "`local static thread guard'" ], [ 242944, "`managed vector copy constructor iterator'" ], [ 242992, "`vector vbase copy constructor iterator'" ], [ 243040, "`vector copy constructor iterator'" ], [ 243080, "`dynamic atexit destructor for '" ], [ 243120, "`dynamic initializer for '" ], [ 243152, "`eh vector vbase copy constructor iterator'" ], [ 243200, "`eh vector copy constructor iterator'" ], [ 243240, "`managed vector destructor iterator'" ], [ 243280, "`managed vector constructor iterator'" ], [ 243320, "`placement delete[] closure'" ], [ 243352, "`placement delete closure'" ], [ 243384, "`omni callsig'" ], [ 243400, "delete[]" ], [ 243424, "`local vftable constructor closure'" ], [ 243464, "`local vftable'" ], [ 243496, "`udt returning'" ], [ 243512, "`copy constructor closure'" ], [ 243544, "`eh vector vbase constructor iterator'" ], [ 243584, "`eh vector destructor iterator'" ], [ 243616, "`eh vector constructor iterator'" ], [ 243656, "`virtual displacement map'" ], [ 243688, "`vector vbase constructor iterator'" ], [ 243728, "`vector destructor iterator'" ], [ 243760, "`vector constructor iterator'" ], [ 243792, "`scalar deleting destructor'" ], [ 243824, "`default constructor closure'" ], [ 243856, "`vector deleting destructor'" ], [ 243888, "`vbase destructor'" ], [ 243928, "`local static guard'" ], [ 244128, "operator" ], [ 244168, "delete" ], [ 244184, "__unaligned" ], [ 244200, "__restrict" ], [ 244224, "__clrcall" ], [ 244240, "__fastcall" ], [ 244256, "__thiscall" ], [ 244272, "__stdcall" ], [ 244288, "__pascal" ], [ 244304, "__cdecl" ], [ 245104, "GetProcessWindowStation" ], [ 245128, "GetUserObjectInformationA" ], [ 245160, "GetLastActivePopup" ], [ 245184, "GetActiveWindow" ], [ 245200, "MessageBoxA" ] ], "sz": 384512, "ts": [ { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token", "e": [ "_ID" ], "i": "objectives/anti-analysis/geofencing/region::country-code-id", "l": 1, "m": "B0007.003" }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PE signature validation in code", "e": [ "3c 0a" ], "i": "objectives/anti-static/obfuscation/imports::pe-signature-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "d": "windir environment variable", "e": [ "installShell g_WinDir: %s" ], "i": "micro-behaviors/os/env/vars/system-info::windir-var", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExW" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "51" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 409600.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 110.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".pdata", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform/defender::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "binary.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 864.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "RegCloseKey", "CloseHandle" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 0.9800000190734863, "d": "Regex component marker", "e": [ "binary.func_count = 1328.00" ], "i": "micro-behaviors/process/terminate/kill::toolhelp-kill-loop-source-cond-6--inline-3846", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "SHGetFolderPathW", "Install Manager: Invalid Path", "SHGetSpecialFolderPathW" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 1328.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1620", "c": 0.8500000238418579, "d": "mscoree.dll text reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-dll-text-ref", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "Download Manager Failed", "DLM_ERROR_NO_ITEM_WAS_DOWNLOADED", "DLM_ERROR_FAILED_DOWNLOAD", "Failed to get Download Manager's settings", "Install Manager: Failed to initialize Download Managerr", "Failed to verify the downloaded file", "Not connected to ATI's Download Manager", "No Such item was downloaded", "Failed to download all the items" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-1", "l": 1, "m": "F0004" }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessW" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Failed to download all the items", "Failed to get Download Manager's settings", "Download Manager Failed", "No Such item was downloaded", "Install Manager: Failed to initialize Download Managerr", "Failed to verify the downloaded file", "Not connected to ATI's Download Manager", "DLM_ERROR_NO_ITEM_WAS_DOWNLOADED", "DLM_ERROR_FAILED_DOWNLOAD" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 3 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.4000000059604645, "d": "HKCU registry hive reference", "e": [ "HKCU" ], "i": "micro-behaviors/os/registry/access::hkcu-hive", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 110.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 110.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "d": "certificate string reference", "e": [ "certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2 }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.224.109:3634" ], "i": "micro-behaviors/communications/ip/endpoint::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "a": "T1027,T1112,T1059.001", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "RegSetValueExW" ], "i": "objectives/command-and-control/dropper/staging/embedded::registry-powershell-byte-payload--rx-4", "l": 1 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.07" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.55" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesA" ], "i": "objectives/evasion/process/injection/callback::enum-locale-callback", "l": 3, "m": "E1106" }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (Unicode)", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.55" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 1328.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/handle::get-console-output-cp", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "Not connected to ATI's Download Manager" ], "i": "micro-behaviors/communications/http/llm::gpt-proxy-websocket-upstream--rx-13", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password" ], "i": "objectives/command-and-control/channel/tunnel/dmw::dmw-tunnel-pwd", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "d": "password keyword", "e": [ "Package Manager Logon failure: unknown user name or bad password." ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder path via Shell32", "e": [ "SHGetFolderPathW" ], "i": "micro-behaviors/fs/shell-ops::shell-get-folder-path", "l": 2 }, { "c": 0.75, "d": "Perform file operation through shell", "e": [ "SHFileOperationW" ], "i": "micro-behaviors/fs/shell-ops::shell-file-operation", "l": 3 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "d": "PDB path on non-standard drive letter", "e": [ "d:\\p4stg\\install\\install\\Monet\\Apps\\bin\\win64a\\b_rel\\installShell64.pdb" ], "i": "metadata/binary/debug::pdb-nonstandard-drive", "l": 3 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 110.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 110.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 110.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.31" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols/imports::imports-advapi32-dll", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 110.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 110.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo", "GetStringTypeA", "invalid string position", "ConvertStringSecurityDescriptorToSecurityDescriptorW", "LCMapStringW", "FreeEnvironmentStringsW", ".?AV?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@", "GetEnvironmentStringsW", "ShellDelete: Could not get source string length", ".?AV?$registry_string@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@@", "string too long", "FreeEnvironmentStringsA", "GetStringTypeW", "LCMapStringA", ".?AV?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@", "GetEnvironmentStrings" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "a": "T1106", "c": 0.8500000238418579, "d": "CreateProcessW API string", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w-string", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllRegisterServer export string", "e": [ "DllRegisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllregisterserver-string", "l": 1, "m": "B0024" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.42" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8199999928474426, "d": "Resolve special folder path directly", "e": [ "SHGetSpecialFolderPathW" ], "i": "micro-behaviors/fs/shell-ops::shell-get-special-folder-path", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.4000000059604645, "d": "HKLM registry hive reference", "e": [ "HKLM" ], "i": "micro-behaviors/os/registry/access::hklm-hive", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "64381" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code IN token", "e": [ "_IN_" ], "i": "objectives/anti-analysis/geofencing/region::country-code-in", "l": 1, "m": "B0007.003" }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 1328.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "0d 00 87 0b", "0a 00 a0 ad", "0a 00 30 a1", "08 00 10 ab", "0c 00 00 8b", "0e 00 10 f4", "08 00 f0 58", "08 00 90 8a", "08 00 50 b7", "08 00 00 84", "06 00 c0 59", "08 00 80 92", "08 00 90 d5", "0e 00 90 20", "08 00 60 ac", "0a 00 a0 af" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 2.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllUnregisterServer export string", "e": [ "DllUnregisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllunregisterserver-string", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.8799999952316284, "d": "High entropy resource section (encrypted payload)", "e": [ "pe.rsrc_entropy = 7.92" ], "i": "well-known/malware/trojan/shellobject/exceldna::xll-high-rsrc-entropy", "l": 1 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "installShell64.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "INSTALLDIR" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "a": "T1082,T1041", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "PM_ERROR_MSI_INSTALL_TEMP_UNWRITABLE" ], "i": "objectives/exfiltration/stealer/system-info::windows-recon-output-file--rx-5", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1243725792.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.func_count = 1328.00" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute-cond-4--inline-11988", "l": 1 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "a": "T1105, T1204.002", "c": 0.8999999761581421, "d": "Italian staged download status", "e": [ "DOWNLOAD", "Download", "download" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst", "l": 1, "m": "E1105" }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\p4stg\\install\\install\\Monet\\Apps\\bin\\win64a\\b_rel\\installShell64.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 3 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "spanish-dominican republic" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "5E2121EE-0300-11D4-8D3B-444553540000", "872A9397-E0D6-4e28-B64D-52B8D0A7EA35", "3135C4E0-0F02-3D95-87C2-5CA05CF5A983" ], "i": "objectives/command-and-control/channel/http::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 3 }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.4000000059604645, "d": "Very few basic blocks (analysis-limited or sparse)", "e": [ "binary.total_basic_blocks = 3.00" ], "i": "metadata/binary/metrics/structural::few-basic-blocks", "l": 3 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "NtCurrentProcess handle (-1) for NT API call", "e": [ "48 C7 C1 FF FF FF FF" ], "i": "objectives/evasion/anti-av/syscall::nt-current-process-handle", "l": 1, "m": "F0004" }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "ff 52 01 00", "57 3f 01 00", "5b 15 01 00", "60 f8 00 00", "03 86 00 00", "4b 01 01 00", "55 fc 00 00", "ca 5a 01 00", "2c b2 00 00", "6b 9c 00 00", "bf 82 00 00", "34 ff 00 00", "fb c0 02 00", "85 8d 00 00", "11 37 01 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "21.48.224.109:6578" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-binary-literal", "l": 1 }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "188.115.124.174:43472", "148.130.193.73:36379", "21.48.224.109:6578" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 3 }, { "c": 0.949999988079071, "d": "Multiple external IPv4 endpoints in PE resources", "e": [ "148.130.193.73:36379", "188.115.124.174:43472" ], "i": "objectives/command-and-control/infrastructure/ip-port::hardcoded-ipv4-port-rsrc-pair", "l": 4 }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{872A9397-E0D6-4e28-B64D-52B8D0A7EA35}", "{5E2121EE-0300-11D4-8D3B-444553540000}", "{3135C4E0-0F02-3D95-87C2-5CA05CF5A983}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 3, "m": "C0042" }, { "c": 0.9200000166893005, "d": "Executable PE resource section", "e": [ ".rsrc (size: 28672, perms: rwx)" ], "i": "metadata/binary/resource::executable-rsrc-section", "l": 4 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.6000000238418579, "d": "High entropy in .rsrc section", "e": [ ".rsrc (entropy: 7.92)" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-rsrc", "l": 3, "m": "C0027" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection/toolkit::module-stomping-target", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "References LoadLibraryA dynamic module loading", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 2.00" ], "i": "metadata/binary/metrics/structural::low-average-complexity", "l": 2 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".rsrc (size: 28672, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 32768.00" ], "i": "metadata/hardening/mitigation::no-aslr-bit", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SunMonTueWedThuFriSat", "WideCharToMultiByte", "SetUnhandledExceptionFilter", "SetNamedPipeHandleState", "InitializeCriticalSectionAndSpinCount", "UnhandledExceptionFilter", "RtlLookupFunctionEntry", "InitializeCriticalSection", "MultiByteToWideChar", "GetProcessWindowStation", "ConvertStringSecurityDescriptorToSecurityDescriptorW", "GetSystemDirectoryW", "GetUserObjectInformationA", "GetWindowsDirectoryW", "GetModuleFileNameW", "JanFebMarAprMayJunJulAugSepOctNovDec" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "binary.wx_sections = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.func_count = 1328.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1027", "c": 0.4000000059604645, "d": "Very small average function size", "e": [ "binary.avg_func_size = 11.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::small-avg-function", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.func_count = 1328.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::function-count-1000-plus", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 1328.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCreateKeyExW, RegQueryInfoKeyW, RegDeleteKeyW, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegOpenKeyExW, ... +3 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (FindFirstFileW, FreeLibrary, CreateProcessW, LoadLibraryExW, WaitForSingleObject, ... +88 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (OleUninitialize, CoInitialize, OleInitialize, CoUninitialize, CoCreateInstance)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHFileOperationW, SHGetFolderPathW, SHGetSpecialFolderPathW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (MessageBoxW)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 110.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsSetValue", "FlsGetValue", "FlsAlloc" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetUserDefaultLCID", "GetLocaleInfoW", "GetLocaleInfoA", "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-environment-fingerprint", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "57 3f 01 00", "60 f8 00 00", "6b 9c 00 00", "bf 82 00 00", "55 fc 00 00", "34 ff 00 00", "ff 52 01 00", "5b 15 01 00", "03 86 00 00", "85 8d 00 00", "11 37 01 00", "4b 01 01 00", "2c b2 00 00", "ca 5a 01 00", "GetTickCount", "fb c0 02 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegCreateKeyExW", "RegSetValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "GetModuleFileNameW", "DeleteFileW" ], "i": "objectives/evasion/self-delete/file/script::module-path-delete", "l": 2, "m": "F0007" }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegCreateKeyExW", "RegSetValueExW", "HKCU", "RegOpenKeyExW", "HKLM" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.overall_entropy = 4.55", "binary.func_count = 1328.00" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "Sleep", "IsDebuggerPresent", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 2, "m": "B0001" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "GetUserDefaultLCID", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetLocaleInfoA", "GetLocaleInfoW", "EnumSystemLocalesA" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection/toolkit::unsigned-module-stomping-target", "l": 1 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" }, { "a": "T1620", "c": 0.9300000071525574, "d": "Native PE loads .NET payload via CLR", "e": [ "mscoree.dll", "LoadLibraryA", "CorExitProcess" ], "i": "objectives/anti-static/obfuscation/payload/loader::native-pe-loads-dotnet-payload", "l": 4, "m": "B0032" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetSystemTimeAsFileTime", "GetUserDefaultLCID", "GetCommandLineW", "EnumSystemLocalesA", "GetLocaleInfoW", "GetEnvironmentStringsW", "GetCommandLineA", "FreeEnvironmentStringsW", "GetLocaleInfoA" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082" } ], "sha": "f21e9ca8169b6ce332afccbbd8bee5cec9b0081f65f6788406c6f45c03e6a968", "path": "64381", "type": "pe" } ], "tv": "84923" } }