23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T484,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 2cd90d07f9b6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2cd90d07f9b6…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2cd90d07f9b6078b4b82b1d2b83407714ecc7ff8818b28d7ab2e0cecbe14f973","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","2cd90d07f9b6078b4b82b1d2b83407714ecc7ff8818b28d7ab2e0cecbe14f973"],"about":{"@type":"SoftwareApplication","name":"mbtrf.exe","applicationCategory":["peexe","executable"],"identifier":"2cd90d07f9b6078b4b82b1d2b83407714ecc7ff8818b28d7ab2e0cecbe14f973","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T59e,Found API call GetVersionExA@KERNEL32.dll (Target: "mbtrf.exe.bin"; Stream UID: "29826-1-004067B0") which is directly followed by "cmp dword ptr [00423AA4h], 02h" and "je 0040684Fh". See related instructions: "... +73 call dword ptr [0041C158h] ;GetVersionExA +79 mov eax, dword ptr [ebp-70h] +82 mov ecx, dword ptr [eax+10h] +85 mov dword ptr [00423AA4h], ecx +91 mov edx, dword ptr [ebp-70h] +94 mov eax, dword ptr [edx+04h] +97 mov dword ptr [00423AB0h], eax +102 mov ecx, dword ptr [ebp-70h] +105 mov edx, dword ptr [ecx+08h] +108 mov dword ptr [00423AB4h], edx +114 mov eax, dword ptr [ebp-70h] +117 mov ecx, dword ptr [eax+0Ch] +120 and ecx, 00007FFFh +126 mov dword ptr [00423AA8h], ecx +132 cmp dword ptr [00423AA4h], 02h +139 je 0040684Fh" ... at 29826-1-004067B0 Found API call GetVersion@KERNEL32.DLL (Target: "mbtrf.exe"; Stream UID: "00013949-00002488-35352-98-004019BB") which is directly followed by "cmp al, 05h" and "jne 004019EEh". See related instructions: "... +30 call dword ptr [00408160h] ;GetVersion +36 cmp al, 05h +38 jne 004019EEh" ... at 00013949-00002488-35352-98-004019BB Found API call GetVersion@KERNEL32.DLL (Target: "adprtext.exe"; Stream UID: "00014471-00002128-38750-98-004019BB") which is directly followed by "cmp al, 05h" and "jne 004019EEh". See related instructions: "... +30 call dword ptr [00408160h] ;GetVersion +36 cmp al, 05h +38 jne 004019EEh" ... at 00014471-00002128-38750-98-004019BB25:T791,"cmd /c ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.348 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.408 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.439 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.469 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.519 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.553 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.586 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.607 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.637 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.677 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.723 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.757 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.780 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.810 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.929 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.963 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:14.986 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:15.017 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:15.047 "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" on 2017-5-30.10:39:15.08726:Tad9,Spawned process "cmd.exe" with commandline "cmd /c ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014367-00003960) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014375-00004008) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014378-00004072) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014381-00004044) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014384-00003932) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014389-00003968) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014393-00004028) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014395-00004012) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014398-00004048) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014401-00001852) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014406-00002240) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014410-00002268) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014412-00002264) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014415-00001100) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014427-00002372) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014430-00002592) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014432-00002324) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014436-00000608) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014439-00001932) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014443-00002424)27:T55e,"" touched file "%WINDIR%\system32\en-US\MSVFW32.dll.mui" "" touched file "%WINDIR%\system32\en-US\PROPSYS.dll.mui" "" touched file "%WINDIR%\Fonts\staticcache.dat" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\system32\en-US\MSCTF.dll.mui" "" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui" "" touched file "%WINDIR%\system32\c_1252.nls" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db"28:Td9b,Spawned process "" (UID: 00013949-00002488) Spawned process "cmd.exe" with commandline "cmd /c ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014367-00003960) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014375-00004008) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014378-00004072) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014381-00004044) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014384-00003932) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014389-00003968) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014393-00004028) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014395-00004012) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014398-00004048) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014401-00001852) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014406-00002240) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014410-00002268) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014412-00002264) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014415-00001100) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014427-00002372) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014430-00002592) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014432-00002324) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014436-00000608) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014439-00001932) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014443-00002424) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014446-00001740) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014451-00004076) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014467-00002404) Spawned process "cmd.exe" with commandline "cmd /C ""%APPDATA%\MICROS~1\Cmdisvc6\adprtext.exe" "C:\mbtrf.exe""" (UID: 00014469-00002640) Spawned process "adprtext.exe" with commandline ""C:\mbtrf.exe"" (UID: 00014471-00002128)29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A/////////////////////wAAAAAAAAAAAAAAAAAAAP8AAAAAAAAAAAAAAAAAAAD/AAAAAAAAAAAAAAAAAAAA/wAAAAAAAAAAAAAAAAAAAP8AAAAAAAAAAAAAAAAAAAD/AAAAAAAAAAAAAAAAAAAA/wAAAAAAAAAAAAAAAAAAAP8AAAAAAAAAAAAAAAAAAAD/AAAAAAAAAAAAAAAAAAAA/wAAB3AAAAAAAAAAAAAAAP8AAA/4EAAAAAAAAAAAAAD/AAABj4AAAAAAAAAAAAAA/wAAAAj3AAAAAAAAAAAAAP8AAAAH//gAAAAAAAAAAAD/AAAAAP/4AAAAAAAAAAAA/wAAAAAPcAAAAAAAAAAAAP8AAAAAB/+AAAAAAAAAAAD/AAAAAAAXgAAAAAAAAAAA/wAAAAAAAAAAAAAAAAAAAP8AAAAAAAAAAAAAAAAAAAD/AAAAAAAAAAAAAAAAAAAA/wAAAAAAAAAAAAAAAAAAAP8AAAAAAAAAAAAAAAAAAAD/AAAAAAAAAAAAAAAAAAAA/wAAAAAAAAAAAAAAAAAAAP8AAAAAAAAAAAAAAAAAAAD/AAAAAAAAAAAAAAAAAAAA/wAAAAAAAAAAAAAAAAAAAP8AAAAAAAAAAAAAAAAAAAD/AAAAAAAAAAAAAAAAAAAA/wAAAAAAAAAAAAAAAAAAAP//////////////////////wAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAAAgAAAAIAAAACAAAAAwAAAA+AAAAfwAAAP+AAAH////////////////w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"2cd90d07f9b6078b4b82b1d2b83407714ecc7ff8818b28d7ab2e0cecbe14f973","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790273784492,"unified_at":"2026-09-24T18:16:24.492Z","metadata":{"hashes":{"sha256":"2cd90d07f9b6078b4b82b1d2b83407714ecc7ff8818b28d7ab2e0cecbe14f973","sha1":"f8c61ed9ad2770937100f93c1535af4c4825c03c","md5":"1138a97b311d27dfc64a0bbaddb952ed","sha512":"e69d39b23f5bde1efed56410c99ad538e225f73e718e2883c62a8a13da727830bc69906b24a07695ed613bc07346e37f26b642c1b47d845dfb77ca0fa967cc00","ssdeep":"12288:HBSaMxvPbgfSVDMrGV4R8gnS3OIj4mvNDBrvIw2UBuXh0cwasZy/N26SuQM8SO7p:0vND9QUCmla+4N2GQM6T9","ssdeep_chunks":["12288:HBSaMxv","12288:BSaMxvP","12288:SaMxvPb","12288:aMxvPbg","12288:MxvPbgf","12288:xvPbgfS","12288:vPbgfSV","12288:PbgfSVD","12288:bgfSVDM","12288:gfSVDMr","12288:fSVDMrG","12288:SVDMrGV","12288:VDMrGV4","12288:DMrGV4R","12288:MrGV4R8","12288:rGV4R8g","12288:GV4R8gn","12288:V4R8gnS","12288:4R8gnS3","12288:R8gnS3O","12288:8gnS3OI","12288:gnS3OIj","12288:nS3OIj4","12288:S3OIj4m","12288:3OIj4mv","12288:OIj4mvN","12288:Ij4mvND","12288:j4mvNDB","12288:4mvNDBr","12288:mvNDBrv","12288:vNDBrvI","12288:NDBrvIw","12288:DBrvIw2","12288:BrvIw2U","12288:rvIw2UB","12288:vIw2UBu","12288:Iw2UBuX","12288:w2UBuXh","12288:2UBuXh0","12288:UBuXh0c","12288:BuXh0cw","12288:uXh0cwa","12288:Xh0cwas","12288:h0cwasZ","12288:0cwasZy","12288:cwasZy/","12288:wasZy/N","12288:asZy/N2","12288:sZy/N26","12288:Zy/N26S","12288:y/N26Su","12288:/N26SuQ","12288:N26SuQM","12288:26SuQM8","12288:6SuQM8S","12288:SuQM8SO","12288:uQM8SO7","12288:QM8SO7p","24576:HBSaMxv","24576:BSaMxvP","24576:SaMxvPb","24576:aMxvPbg","24576:MxvPbgf","24576:xvPbgfS","24576:vPbgfSV","24576:PbgfSVD","24576:bgfSVDM","24576:gfSVDMr","24576:fSVDMrG","24576:SVDMrGV","24576:VDMrGV4","24576:DMrGV4R","24576:MrGV4R8","24576:rGV4R8g","24576:GV4R8gn","24576:V4R8gnS","24576:4R8gnS3","24576:R8gnS3O","24576:8gnS3OI","24576:gnS3OIj","24576:nS3OIj4","24576:S3OIj4m","24576:3OIj4mv","24576:OIj4mvN","24576:Ij4mvND","24576:j4mvNDB","24576:4mvNDBr","24576:mvNDBrv","24576:vNDBrvI","24576:NDBrvIw","24576:DBrvIw2","24576:BrvIw2U","24576:rvIw2UB","24576:vIw2UBu","24576:Iw2UBuX","24576:w2UBuXh","24576:2UBuXh0","24576:UBuXh0c","24576:BuXh0cw","24576:uXh0cwa","24576:Xh0cwas","24576:h0cwasZ","24576:0cwasZy","24576:cwasZy/","24576:wasZy/N","24576:asZy/N2","24576:sZy/N26","24576:Zy/N26S","24576:y/N26Su","24576:/N26SuQ","24576:N26SuQM","24576:26SuQM8","24576:6SuQM8S","24576:SuQM8SO","24576:uQM8SO7","24576:QM8SO7p","12288:0vND9QU","12288:vND9QUC","12288:ND9QUCm","12288:D9QUCml","12288:9QUCmla","12288:QUCmla+","12288:UCmla+4","12288:Cmla+4N","12288:mla+4N2","12288:la+4N2G","12288:a+4N2GQ","12288:+4N2GQM","12288:4N2GQM6","12288:N2GQM6T","12288:2GQM6T9"],"imphash":"5efab9e4d45840c547d1337dbde48616"},"file_info":{"file_name":"mbtrf.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":487424,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286761000,"last_seen":1653199493000,"last_multi_scan":1653199493000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":19,"suspicious_count":17,"malicious_count":6,"total":42},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ursnif.trZx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ursnif","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/Win32.Ursnif","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.UrsnifDropper.sxytz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.5221147","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Ursnif.YPMW-1328","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.5221147 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Spy.Ursnif.AO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Remcos","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050eeab1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Ursnif.sby","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.acf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Gozi.eqttvr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Gozi-HV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan Horse","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-Spy/W32.Ursnif.487424","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_UR.6DF0E099","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_UR.6DF0E099","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ursnif.E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanSpy.Ursnif","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Ursnif.Win32.992","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 29826-516-0040FE50\n SetUnhandledExceptionFilter@KERNEL32.dll at 29826-515-0040FE70","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 29826-494-00416830","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.dll at 29826-1-004067B0\n GetVersion@KERNEL32.DLL at 00013949-00002488-35352-98-004019BB\n GetVersionExW@KERNEL32.DLL at 00013949-00002488-35352-82-00405200\n GetVersionExW@KERNEL32.DLL at 00014471-00002128-38750-82-00405200\n GetVersion@KERNEL32.DLL at 00014471-00002128-38750-98-004019BB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$24","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MBTRF.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MBTRF.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\315A.BAT\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\315A.BAT\")\n \"adprtext.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ADPRTEXT.EXE\")\n \"adprtext.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ADPRTEXT.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/60 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as goodware by Antivirus engines","description":"Microsoft Corporation marked the input file as goodware","origin":"External System","relevance":10,"id":"avtest-2","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\nndefault\\Postal\\drained\\IsVers.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\3FB4\\315A.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"explorer.exe\" (UID: 00019866-00001268) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"explorer.exe\" (UID: 00019866-00001268) was launched with missing environment variables: \"PROMPT, MpConfig_ProductUserAppDataPath, MpConfig_ProductAppDataPath, MpConfig_ProductPath, MpConfig_ProductCodeName, MpConfig_ReportingGUID\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$25","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"ProgMan\"\n \"adprtext.exe\" searching for class \"ProgMan\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"adprtext.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"adprtext.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"315A.bat\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"adprtext.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"mbtrf.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"adprtext.exe\" queried SystemProcessInformation at 00014471-00002128-00000105-55053392","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Scanning for process managers","description":"\"\" searching for class \"ProgMan\"\n \"adprtext.exe\" searching for class \"ProgMan\"","origin":"API Call","relevance":10,"id":"api-15","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.7244482239","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"vbox\" (Indicator: \"vbox\")\n \"qemu\" (Indicator: \"qemu\")\n \"vmware\" (Indicator: \"vmware\")\n \"virtual hd\" (Indicator: \"virtual hd\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"adprtext.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"adprtext.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"TAPISRV\" service\n \"adprtext.exe\" called \"OpenService\" to access the \"TAPISRV\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"adprtext.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"API-GSVC\"; Value: \"%APPDATA%\\Microsoft\\Cmdisvc6\\adprtext.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" marked \"C:\\mbtrf.exe\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"adprtext.exe\" opened \"C:\\mbtrf.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetVersionExA\n GetModuleFileNameA\n LoadLibraryA\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n OutputDebugStringA\n TerminateProcess\n GetTickCount\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053257758582677186a2677653c27770000000000bf6b750000000056cc6b75000000007cca6b750000000037683f756a2c2777d62d27770000000020693f750000000029a66b7500000000a48d3f7500000000f70e6b7500000000\" to virtual address \"0x77411000\" (part of module \"NSI.DLL\")\n \"adprtext.exe\" wrote bytes \"4053257758582677186a2677653c27770000000000bf6b750000000056cc6b75000000007cca6b750000000037683f756a2c2777d62d27770000000020693f750000000029a66b7500000000a48d3f7500000000f70e6b7500000000\" to virtual address \"0x77411000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"adprtext.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"\"Found VM detection artifact \"CPUID trick\" in \"mbtrf.exe.bin\" (Offset: 119140)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"4/61 Antivirus vendors marked spawned process \"\" (PID: 2488) as malicious (classified as \"virus.win32.parite\" with 6% detection rate)\n 4/61 Antivirus vendors marked spawned process \"adprtext.exe\" (PID: 2128) as malicious (classified as \"virus.win32.parite\" with 6% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00019866-00001268)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2017-5-30.10:40:09.490 (UID: 00019866-00001268)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtUnmapViewOfSection@NTDLL.DLL at 00013949-00002488-35352-8-00404106\n NtQuerySystemInformation@NTDLL.DLL at 00013949-00002488-35352-3-00402F2A\n NtQueryVirtualMemory@NTDLL.DLL at 00013949-00002488-35352-143-0040779D\n NtMapViewOfSection@NTDLL.DLL at 00013949-00002488-35352-33-00404B37\n NtOpenProcess@NTDLL.DLL at 00013949-00002488-35352-93-00401B1E\n NtCreateSection@NTDLL.DLL at 00013949-00002488-35352-34-00404B76\n NtQueryInformationProcess@NTDLL.DLL at 00013949-00002488-35352-42-00402D78\n NtUnmapViewOfSection@NTDLL.DLL at 00014471-00002128-38750-8-00404106\n NtQuerySystemInformation@NTDLL.DLL at 00014471-00002128-38750-3-00402F2A\n NtMapViewOfSection@NTDLL.DLL at 00014471-00002128-38750-33-00404B37\n NtQueryVirtualMemory@NTDLL.DLL at 00014471-00002128-38750-143-0040779D\n NtCreateSection@NTDLL.DLL at 00014471-00002128-38750-34-00404B76\n NtOpenProcess@NTDLL.DLL at 00014471-00002128-38750-93-00401B1E\n NtQueryInformationProcess@NTDLL.DLL at 00014471-00002128-38750-42-00402D78","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$28","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]}],"incidents":[{"name":"Persistence","details_count":4,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Injects into remote processes"},{"detail":"Spawns a lot of processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]}]},"activity":{"stats":{"process_count":27,"spawned_processes_count":27,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":49,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":22,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"592d3c4caac2ed4e0ac73c61","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"virus.win32.parite","submit_name":"mbtrf.exe","analysis_start_time":"2017-05-30T10:38:31+00:00","indicators_count":{"informative":19,"suspicious":17,"malicious":6},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}],"processes":[{"pid":2488,"ppid":0,"name":"mbtrf.exe","command_line":"","sha256":"2cd90d07f9b6078b4b82b1d2b83407714ecc7ff8818b28d7ab2e0cecbe14f973","normalized_path":"C:\\mbtrf.exe","uid":"00013949-00002488","icon":"$29"},{"pid":3960,"ppid":2488,"name":"cmd.exe","command_line":"cmd /c \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013949-00002488","uid":"00014367-00003960"},{"pid":4008,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014375-00004008"},{"pid":4072,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014378-00004072"},{"pid":4044,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014381-00004044"},{"pid":3932,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014384-00003932"},{"pid":3968,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014389-00003968"},{"pid":4028,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014393-00004028"},{"pid":4012,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014395-00004012"},{"pid":4048,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014398-00004048"},{"pid":1852,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014401-00001852"},{"pid":2240,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014406-00002240"},{"pid":2268,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014410-00002268"},{"pid":2264,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014412-00002264"},{"pid":1100,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014415-00001100"},{"pid":2372,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014427-00002372"},{"pid":2592,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014430-00002592"},{"pid":2324,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014432-00002324"},{"pid":608,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014436-00000608"},{"pid":1932,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014439-00001932"},{"pid":2424,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014443-00002424"},{"pid":1740,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014446-00001740"},{"pid":4076,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014451-00004076"},{"pid":2404,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014467-00002404"},{"pid":2640,"ppid":3960,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe\" \"C:\\mbtrf.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014367-00003960","uid":"00014469-00002640"},{"pid":2128,"ppid":2640,"name":"adprtext.exe","command_line":"\"C:\\mbtrf.exe\"","sha256":"2cd90d07f9b6078b4b82b1d2b83407714ecc7ff8818b28d7ab2e0cecbe14f973","normalized_path":"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe","parent_uid":"00014469-00002640","uid":"00014471-00002128"},{"pid":1268,"ppid":2128,"name":"explorer.exe","command_line":"%WINDIR%\\Explorer.EXE","sha256":"0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00014471-00002128","uid":"00019866-00001268"}],"all_imported_dlls":["sechost.dll","ole32.dll","IPHLPAPI.DLL","msctf.dll","propsys.dll","profapi.dll","winbrand.dll","lpk.dll","shell32.dll","traffic.dll","winnsi.dll","uxtheme.dll","wininet.dll","msvfw32.dll","oleaut32.dll","setupapi.dll","devobj.dll","ntmarta.dll","KernelBase.dll","gdi32.dll","advapi32.dll","winmm.dll","msasn1.dll","urlmon.dll","apphelp.dll","tapi32.dll","sspicli.dll","clbcatq.dll","cfgmgr32.dll","Wldap32.dll","iertutil.dll","kernel32.dll","user32.dll","rpcrt4.dll","comctl32.dll","nsi.dll","ws2_32.dll","cryptbase.dll","crypt32.dll","usp10.dll","msvcrt.dll","shlwapi.dll","imm32.dll","wintrust.dll","ntdll.dll","avifil32.dll","msacm32.dll","rpcss.dll","dwmapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"adprtext.exe","sha256":"2cd90d07f9b6078b4b82b1d2b83407714ecc7ff8818b28d7ab2e0cecbe14f973","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"name":"315A.bat","sha256":"83410e10a86c0d14b877af5564edd1f829cd4bbf42ffadfac66c4050cdfc2da0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]}],"files_written":[{"path":"%APPDATA%\\Microsoft\\Cmdisvc6\\adprtext.exe","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%TEMP%\\3FB4\\315A.tmp","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%APPDATA%\\MICROS~1\\Cmdisvc6\\adprtext.exe","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%WINDIR%\\system32\\en-US\\MSVFW32.dll.mui","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"c:\\321.txt","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%WINDIR%\\system32\\c_1252.nls","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%APPDATA%\\Microsoft\\Cmdisvc6","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%WINDIR%\\SYSTEM32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"path":"%TEMP%\\3FB4\\315A.bat","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\1BF08513-BEE6-055F-A07F-D209D423264D\\","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"key":"HKCU\\","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"592d3c4caac2ed4e0ac73c61"}]}]}},"report_ids":{"sandbox_job_ids":["592d3c4caac2ed4e0ac73c61"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 2cd90d07f9b6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2cd90d07f9b6…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2cd90d07f9b6078b4b82b1d2b83407714ecc7ff8818b28d7ab2e0cecbe14f973"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 2cd90d07f9b6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2cd90d07f9b6…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2cd90d07f9b6078b4b82b1d2b83407714ecc7ff8818b28d7ab2e0cecbe14f973"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 2cd90d07f9b6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2cd90d07f9b6…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]