24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4cb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/grayware_confidence_100% Sample e2b3c3d7de98… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e2b3c3d7de98…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 11/25 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3","keywords":["Malicious","Win/grayware_confidence_100%","malware analysis","sandbox report","threat intelligence","e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3"],"about":{"@type":"SoftwareApplication","name":"Patch-BBT.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/grayware_confidence_100%","antivirusDetections":{"malicious":11,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5db,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll.aux" ".exe" touched file "C:\Windows\System32\rsaenh.dll" ".exe" touched file "C:\Windows\Fonts\tahoma.ttf" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" ".exe" touched file "C:\Windows\assembly\pubpol247.dat" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll.aux"26:Td3f,".exe" wrote bytes "00000000000000000000000000000000030000008e000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" to virtual address "0x0122C000" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "00000000" to virtual address "0x0122E380" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "00000000" to virtual address "0x0122E3A0" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "0000000000000000" to virtual address "0x010601A0" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "00000000" to virtual address "0x0122E384" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "00000000" to virtual address "0x0122E3A4" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "db4da06e00000000" to virtual address "0x012C0000" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "0000000000000000" to virtual address "0x010601C8" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "00000000" to virtual address "0x0122E34C" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "4e74436f6e74696e756500" to virtual address "0x0122E332" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "9f75c3bb" to virtual address "0x6A09F798" (part of module "CLR.DLL") ".exe" wrote bytes "00000000" to virtual address "0x0122E3B0" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "00000000" to virtual address "0x0122E374" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "00000000" to virtual address "0x0122E394" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "00000000" to virtual address "0x0122E3B4" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "c04ead772054ae77e065ae77b538af770000000000d0287600000000c5ea28760000000088ea287600000000e968bc758228af77ee29af7700000000d269bc75000000007dbb28760000000009bebc7500000000ba18287600000000" to virtual address "0x76371000" (part of module "NSI.DLL") ".exe" wrote bytes "6e74646c6c2e646c6c0000" to virtual address "0x0122E33E" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "0000000000000000" to virtual address "0x01060178" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE") ".exe" wrote bytes "0000000000000000" to virtual address "0x01060218" (part of module "E2B3C3D7DE982F2A7ABBC34300CBA1DEA4D52AF24E88B4D944FF938FBFA479C3.EXE")27:Tc04,"CreateCompatibleDC" (Indicator: "CreateCompatibleDC") "add_Deselected" (Indicator: "select") "FillRectangle" (Indicator: "FillRect") "ReleaseCapture" (Indicator: "ReleaseCapture") "selectedItem" (Indicator: "select") "GetCurrentProcess" (Indicator: "GetCurrentProcess") "DeleteObject" (Indicator: "DeleteObject") "SelectObject" (Indicator: "SelectObject") "VirtualProtect" (Indicator: "VirtualProtect") "GetSystemMenu" (Indicator: "GetSystemMenu") "TrackPopupMenuEx" (Indicator: "TrackPopupMenu") ""Occurs when selected index change." (Indicator: "select"), ""Occurs when selected value change." (Indicator: "select") "IGets a collection containing the currently selected items in the ListBox." (Indicator: "select") "8Gets or sets the currently selected item in the ListBox." (Indicator: "select") "0Gets the currently selected Text in the ListBox." (Indicator: "select") "NGets or sets the zero-based index of the currently selected item in a ListBox." (Indicator: "select") "nLevel level="requireAdministrator" uiAccess="false" /> A list of the Windows versions that this application has been tested on and is designed to work with. Uncomment the appropriate elements and Windows will automatically select the most compatible environment. --> Windows Vista --> --> Windows 7 --> --> Windows 8 --> --> Windows 8.1 --> --> Windows 10 --> --> true true --> Enable themes for Windows common controls and dialogs (Windows XP and later) --> " (Indicator: "EnableWindow") "ThemeApiConnectionRequest" (Indicator: "ThemeApiConnectionRequest")28:T491,"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3.bin" file has an entrypoint instructions - "jmpdword ptr [0x660000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,"29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB//////////4cAAAAAAAAH////////////+AAAAAAAD/////+Id3d3iP/3AAAAAA////+Hd3d3d3d4/4AAAAAP///4d3d3d3d3d4/4AAAAD///h3d3l5d3d3d4/3AAAA//+Hd3d5mZmZmZmY/wAAAP/4d3d3d5mZmZmZmY+AAAD/93d3d3d5mZl7u7d/8AAA/4d3d3d3d5e7u7u7v/cAAP93d3d3d3e7u7u7u7j4AAD/d3d3d3due7u7u7u7/wAA/3d3d3du7ui7u7u7u/8AAP93d3du7u7ui7u7u7v/AAD/Zm7u7u7u7uu7u7u7/wAA/27u7u7u7u7nu7u7u/8AAP/u7u7u7u7u7nu7u7v/AAD/ju7u7u7u7u7ni7u4/wAAj4bu7u7u7u7u7ui7v/gAAA/37u7u7u7u7u7u6I/wAAAI+G7u7u7u7u7u7ub/gAAAB/+G7u7u7u7u7u5o/wAAAACP+Hfn7u7u7nd3j/gAAAAACP+Hd3d3d3d3eP+AAAAAAACP+Id3d3d3eI/4AAAAAAAACP/4h3d3eP//gAAAAAAAAAAP////////gAAAAAAAAAAAAAj/////gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgAA//wAAB/4AAAH+AAAA/gAAAH4AAAA+AAAAHgAAAB4AAAAOAAAADgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABwAAAA8AAAAPgAAAH4AAAD/AAAA/4AAAf/AAAf/8AAP//wAP//////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790568126520,"unified_at":"2026-09-28T04:02:06.520Z","metadata":{"hashes":{"sha256":"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3","sha1":"3305446365a260f3d2e2d5437cccb6dff5816ed9","md5":"537cf278960705c0682c2a443bf235a4","sha512":"0fc0a73a29b6c2b10a654ce47130c703253d23ebeb3e12c24f30ff60ce367ed316d69d24daf1e72a53c8e1faa2e57beec515543b1849b4ccc49e1327db8e4848","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Patch-BBT.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":2472960,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1623668501000,"last_seen":1787852802000,"last_multi_scan":1787852802000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["floxif","mofksys","neshta"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":21},"sandbox_signatures":{"informative_count":21,"suspicious_count":22,"malicious_count":5,"total":48},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"GrayWare/Win32.Uwamson","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Keygen.NA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.AEFS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.03013681","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 00584baa1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"ApplicUnwnt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/grayware_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"60cab404b29b7173831da96e"},{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to write data into process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"suspicious","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Read system defined device setup information from registry"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Base of code of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"Found reference to API \"BRk[\" (Indicator: \"brk\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"60cab404b29b7173831da96e"},{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"_@5p.m\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"60cab404b29b7173831da96e"},{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/68 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"60cab404b29b7173831da96e"},{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/35 Antivirus vendors marked sample as malicious (2% detection rate)\n 13/68 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"60cab404b29b7173831da96e"},{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3.exe\" at 00064850-00003776-0000010C-3757546","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 68C80000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3.bin\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00064850-00003776-00000105-5231541","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00064850-00003776-00000105-22332619915436858\n \".exe\" queried SystemProcessInformation at 00064850-00003776-00000105-22332619915441251","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"\n@$D[{ with unusual entropies 7.99989179019","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$26","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write data into process memory (API string)","description":"Observed api string:\"WriteProcessMemory\" [Source: 00000000-00007896.00000002.77945.001D2000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Patch-BBT.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7896:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7896:64:WilError_01\"\n \"Local\\SM0:7896:168:WilStaging_02\"\n \"Local\\SM0:7896:64:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$27","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Patch-BBT.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3.bin\" has an executable section named \",@$D[{\"\n \"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3.bin\" has an executable section named \".text\"\n \"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3.bin\" has an executable section named \"\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3.bin\" has an writable section named \",@$D[{\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$28","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Patch-BBT.exe.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Patch-BBT.exe.log]- [targetUID: 00000000-00007896]","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"-- Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher\n DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need \n to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should \n also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config. \n \n Makes the application long-path aware. See https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation -->\n \n \n \n true\n true\n \n \n -->\n\n Enable themes for Windows common controls and dialogs (Windows XP and later) -->\n \n \" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"Patch-BBT.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00007896)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindNextFileW\" [Source: 00000000-00007896.00000002.77945.001D2000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"00000000-00007896.00000002.77945.001D2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3.bin\" has resource with unusual entropy \"RT_ICON:7.96053635896\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"Patch-BBT.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 1524581632)\n \"Patch-BBT.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1524581633)\n \"Patch-BBT.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\" (Filter: 268435461; Subtree: 1524581633)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Patch-BBT.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Patch-BBT.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00007896)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Patch-BBT.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00007896)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"Patch-BBT.exe\" called \"FindFirstFileW\" (UID: 00000000-00007896)\n \"Patch-BBT.exe\" called \"FindNextFileW\" (UID: 00000000-00007896)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"Patch-BBT.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":8,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"Patch-BBT.exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Patch-BBT.exe\" called \"AdjustTokenPrivileges\" (UID: 00000000-00007896)","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"GetAsyncKeyState@USER32.DLL\" in \"Patch-BBT.exe\"\n \"GetForegroundWindow@USER32.DLL\" in \"Patch-BBT.exe\"\n \"Wow64Transition@NTDLL.DLL\" in \"Patch-BBT.exe\"\n \"GetKeyState@USER32.DLL\" in \"Patch-BBT.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]}],"incidents":[{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]}],"intel_graph":{"map":{"File:d6a92016715b20d0c166a831bd0da8b10160792a4a25bdd3b941566e76b59be1":{"type":"File","value":"d6a92016715b20d0c166a831bd0da8b10160792a4a25bdd3b941566e76b59be1"},"File:e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3":{"type":"File","value":"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3"}},"chains":[{"id":"sandbox_files","root":"File:e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3","edges":[{"edge_kind":"extracted","from_key":"File:e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3","to_key":"File:d6a92016715b20d0c166a831bd0da8b10160792a4a25bdd3b941566e76b59be1"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":80,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":36,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["floxif","mofksys","neshta"],"sample_flags":["User Comment","Extracted Files","Simulated analysis"],"sandbox_reports":[{"id":"634fd7c4a2d63e666551381b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Keygen","submit_name":"Patch-BBT.exe","analysis_start_time":"2022-10-19T10:56:05+00:00","indicators_count":{"informative":17,"suspicious":24,"malicious":3},"tags":["Extracted Files","User Comment","Simulated analysis"],"is_in_unified_schema":true},{"id":"60e88483e450f83a2052eb53","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"BehavesLike.Generic","submit_name":"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3","analysis_start_time":"2021-07-09T17:17:02+00:00","indicators_count":{"informative":7,"suspicious":12,"malicious":3},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"60cab404b29b7173831da96e","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":63,"malware_family":"Unsafe.AI_Score_99%","submit_name":"Patch-BBT.exe","analysis_start_time":"2021-06-17T02:46:44+00:00","indicators_count":{"informative":1,"suspicious":1,"malicious":3},"tags":["User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}],"processes":[{"pid":3776,"ppid":0,"name":"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3.exe","command_line":"","sha256":"e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3","normalized_path":"C:\\e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3.exe","uid":"00064850-00003776","icon":"$29"}],"all_imported_dlls":["clbcatq.dll","user32.dll","oleaut32.dll","msvcrt.dll","version.dll","ucrtbase_clr0400.dll","cryptbase.dll","profapi.dll","bcrypt.dll","lpk.dll","mscoreei.dll","clr.dll","comctl32.dll","mscoree.dll","ws2_32.dll","shlwapi.dll","shell32.dll","nsi.dll","imm32.dll","uxtheme.dll","clrjit.dll","System.Configuration.ni.dll","cryptsp.dll","msctf.dll","System.Windows.Forms.ni.dll","sechost.dll","psapi.dll","RpcRtRemote.dll","dwmapi.dll","ntdll.dll","System.Xml.ni.dll","KernelBase.dll","advapi32.dll","api-ms-win-core-synch-l1-2-0.dll","rsaenh.dll","GdiPlus.dll","mscorrc.dll","ole32.dll","kernel32.dll","rpcrt4.dll","mscorlib.ni.dll","api-ms-win-core-xstate-l2-1-0.dll","System.ni.dll","System.Drawing.ni.dll","System.Core.ni.dll","gdi32.dll","usp10.dll","vcruntime140_clr0400.dll","rpcss.dll","System.Windows.Forms.dll","nlssorting.dll","msvcp_win.dll","WinTypes.dll","windows.storage.dll","wow64.dll","wintrust.dll","sspicli.dll","win32u.dll","msasn1.dll","CoreMessaging.dll","ntmarta.dll","kernel.appcore.dll","SHCore.dll","CoreUIComponents.dll","cfgmgr32.dll","combase.dll","TextInputFramework.dll","bcryptprimitives.dll","ucrtbase.dll","fltLib.dll","wow64win.dll","crypt32.dll","powrprof.dll","wow64cpu.dll","gdi32full.dll","DWrite.dll","wldp.dll","amsi.dll","userenv.dll","apphelp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Patch-BBT.exe.log","sha256":"d6a92016715b20d0c166a831bd0da8b10160792a4a25bdd3b941566e76b59be1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"C:\\e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3.exe.config","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"C:\\e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3.exe","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\assembly\\pubpol247.dat","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"},{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Fonts\\NIRMALA.TTF","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Fonts\\NIRMALAB.TTF","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Patch-BBT.exe.log","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"60e88483e450f83a2052eb53"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7896:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"name":"Local\\SM0:7896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]},{"name":"Local\\SM0:7896:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"634fd7c4a2d63e666551381b"}]}]}},"report_ids":{"sandbox_job_ids":["634fd7c4a2d63e666551381b","60e88483e450f83a2052eb53","60cab404b29b7173831da96e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/grayware_confidence_100% Sample e2b3c3d7de98… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e2b3c3d7de98…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 11/25 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/grayware_confidence_100% Sample e2b3c3d7de98… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e2b3c3d7de98…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 11/25 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e2b3c3d7de982f2a7abbc34300cba1dea4d52af24e88b4d944ff938fbfa479c3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/grayware_confidence_100% Sample e2b3c3d7de98… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e2b3c3d7de98…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 11/25 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]