{
  "artifact": "14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3",
  "artifact_type": "hash",
  "session_id": "f8c66060-4bfb-4eda-a201-47d5630305f2",
  "suspicion_score": 89,
  "verdict": "highly suspicious",
  "summary": "14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3 was classified as hash. Investigation verdict is highly suspicious with score 89/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 36 ATT&CK technique lead(s) and 0 actor lead(s).",
  "actors": [],
  "techniques": [
    {
      "attack_id": "T1012",
      "name": "Query Registry",
      "tactics": [
        "discovery"
      ],
      "url": "https://attack.mitre.org/techniques/T1012",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1016",
      "name": "System Network Configuration Discovery",
      "tactics": [
        "discovery"
      ],
      "url": "https://attack.mitre.org/techniques/T1016",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1018",
      "name": "Remote System Discovery",
      "tactics": [
        "discovery"
      ],
      "url": "https://attack.mitre.org/techniques/T1018",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactics": [
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1027",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1027.005",
      "name": "Indicator Removal from Tools",
      "tactics": [
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1027/005",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1036",
      "name": "Masquerading",
      "tactics": [
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1036",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1055",
      "name": "Process Injection",
      "tactics": [
        "stealth",
        "privilege-escalation"
      ],
      "url": "https://attack.mitre.org/techniques/T1055",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1056",
      "name": "Input Capture",
      "tactics": [
        "collection",
        "credential-access"
      ],
      "url": "https://attack.mitre.org/techniques/T1056",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1056.001",
      "name": "Keylogging",
      "tactics": [
        "collection",
        "credential-access"
      ],
      "url": "https://attack.mitre.org/techniques/T1056/001",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1057",
      "name": "Process Discovery",
      "tactics": [
        "discovery"
      ],
      "url": "https://attack.mitre.org/techniques/T1057",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactics": [
        "execution"
      ],
      "url": "https://attack.mitre.org/techniques/T1059",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1070",
      "name": "Indicator Removal",
      "tactics": [
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1070",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1070.004",
      "name": "File Deletion",
      "tactics": [
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1070/004",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1071",
      "name": "Application Layer Protocol",
      "tactics": [
        "command-and-control"
      ],
      "url": "https://attack.mitre.org/techniques/T1071",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1082",
      "name": "System Information Discovery",
      "tactics": [
        "discovery"
      ],
      "url": "https://attack.mitre.org/techniques/T1082",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1083",
      "name": "File and Directory Discovery",
      "tactics": [
        "discovery"
      ],
      "url": "https://attack.mitre.org/techniques/T1083",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1112",
      "name": "Modify Registry",
      "tactics": [
        "defense-impairment",
        "persistence"
      ],
      "url": "https://attack.mitre.org/techniques/T1112",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1129",
      "name": "Shared Modules",
      "tactics": [
        "execution"
      ],
      "url": "https://attack.mitre.org/techniques/T1129",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1134",
      "name": "Access Token Manipulation",
      "tactics": [
        "stealth",
        "privilege-escalation"
      ],
      "url": "https://attack.mitre.org/techniques/T1134",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1218",
      "name": "System Binary Proxy Execution",
      "tactics": [
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1218",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1218.010",
      "name": "Regsvr32",
      "tactics": [
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1218/010",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1218.011",
      "name": "Rundll32",
      "tactics": [
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1218/011",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1497",
      "name": "Virtualization/Sandbox Evasion",
      "tactics": [
        "stealth",
        "discovery"
      ],
      "url": "https://attack.mitre.org/techniques/T1497",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1518",
      "name": "Software Discovery",
      "tactics": [
        "discovery"
      ],
      "url": "https://attack.mitre.org/techniques/T1518",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1518.001",
      "name": "Security Software Discovery",
      "tactics": [
        "discovery"
      ],
      "url": "https://attack.mitre.org/techniques/T1518/001",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1529",
      "name": "System Shutdown/Reboot",
      "tactics": [
        "impact"
      ],
      "url": "https://attack.mitre.org/techniques/T1529",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1547",
      "name": "Boot or Logon Autostart Execution",
      "tactics": [
        "persistence",
        "privilege-escalation"
      ],
      "url": "https://attack.mitre.org/techniques/T1547",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactics": [
        "persistence",
        "privilege-escalation"
      ],
      "url": "https://attack.mitre.org/techniques/T1547/001",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1564",
      "name": "Hide Artifacts",
      "tactics": [
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1564",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1564.001",
      "name": "Hidden Files and Directories",
      "tactics": [
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1564/001",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1564.003",
      "name": "Hidden Window",
      "tactics": [
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1564/003",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1571",
      "name": "Non-Standard Port",
      "tactics": [
        "command-and-control"
      ],
      "url": "https://attack.mitre.org/techniques/T1571",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1573",
      "name": "Encrypted Channel",
      "tactics": [
        "command-and-control"
      ],
      "url": "https://attack.mitre.org/techniques/T1573",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1574",
      "name": "Hijack Execution Flow",
      "tactics": [
        "stealth",
        "execution"
      ],
      "url": "https://attack.mitre.org/techniques/T1574",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1574.002",
      "name": "",
      "tactics": [],
      "url": "https://attack.mitre.org/techniques/T1574/002/",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1614",
      "name": "System Location Discovery",
      "tactics": [
        "discovery"
      ],
      "url": "https://attack.mitre.org/techniques/T1614",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    }
  ],
  "sources": [
    {
      "source": "local-db",
      "status": "ok",
      "summary": "Found 0 local IOC record(s).",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "virustotal",
      "status": "ok",
      "summary": "57 engines marked malicious and 0 suspicious; 0 harmless, 11 undetected.",
      "technique_ids": [
        "T1012",
        "T1016",
        "T1018",
        "T1027",
        "T1027.005",
        "T1036",
        "T1055",
        "T1056",
        "T1056.001",
        "T1057",
        "T1059",
        "T1070",
        "T1070.004",
        "T1071",
        "T1082",
        "T1083",
        "T1112",
        "T1129",
        "T1134",
        "T1218",
        "T1218.010",
        "T1218.011",
        "T1497",
        "T1518",
        "T1518.001",
        "T1529",
        "T1547",
        "T1547.001",
        "T1564",
        "T1564.001",
        "T1564.003",
        "T1571",
        "T1573",
        "T1574",
        "T1574.002",
        "T1614"
      ],
      "actors": []
    },
    {
      "source": "threatfox",
      "status": "not_found",
      "summary": "ThreatFox returned 0 record(s).",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "malwarebazaar",
      "status": "ok",
      "summary": "MalwareBazaar returned 1 sample record(s).",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "otx",
      "status": "ok",
      "summary": "OTX returned 3 pulse(s).",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "urlscan",
      "status": "ok",
      "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern.",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "greynoise",
      "status": "skipped",
      "summary": "GreyNoise is IP-focused; input is not an IP.",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "abuseipdb",
      "status": "skipped",
      "summary": "AbuseIPDB is IP-focused; input is not an IP.",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "shodan",
      "status": "skipped",
      "summary": "Shodan host lookup is IP-focused; input is not an IP.",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "censys",
      "status": "skipped",
      "summary": "Censys host and search pivots support IP, domain, and URL inputs.",
      "technique_ids": [],
      "actors": []
    }
  ],
  "graph_counts": {
    "nodes": 6,
    "edges": 6
  },
  "public_note": "Derived platform summary, not the complete provider response. Bulk provider raw data, unrelated pivots and AI-input duplicates are not redistributed. Original response SHA-256 is recorded for provenance, not independently verifiable from this derivative.",
  "original_sha256": "e341f4811bd4db06cdb5a9d245787f928822ff96cb8bb38050f1e7dc1b20e499"
}