patch.exe
This report is generated from a file or URL submitted to this webservice on October 8th 2020 19:17:27 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.43 © Hybrid Analysis
Incident Response
Risk Assessment
- Fingerprint
-
Queries kernel debugger information
Reads the active computer name
Reads the cryptographic machine GUID - Evasive
- Tries to sleep for a long time (more than two minutes)
- Spreading
- Detected a large number of ARP broadcast requests (network device lookup)
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 2
-
External Systems
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 4/70 Antivirus vendors marked sample as malicious (5% detection rate)
- source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by at least one Antivirus engine
-
Network Related
-
Detected a large number of ARP broadcast requests (network device lookup)
- details
- Attempt to find devices in networks: "169.254.133.100/32, 192.168.240.2/32, 192.168.240.142/32, 192.168.241.98/32, 192.168.241.143/32, 192.168.242.2/32, 192.168.242.40/32, 192.168.242.46/32, 192.168.242.239/32, 192.168.243.17/32, 192.168.243.23/32, 192.168.243.38/32, 192.168.243.42/32, 192.168.243.57/32, 192.168.243.100/32, 192.168.243.150/32, 192.168.243.211/32, 192.168.243.233/32"
- source
- Network Traffic
- relevance
- 10/10
- ATT&CK ID
- T1016 (Show technique in the MITRE ATT&CK™ matrix)
-
Detected a large number of ARP broadcast requests (network device lookup)
-
Suspicious Indicators 11
-
Anti-Detection/Stealthyness
-
Queries kernel debugger information
- details
- "patch.exe" at 00064163-00002828-00000105-3666445
- source
- API Call
- relevance
- 6/10
-
Queries kernel debugger information
-
Anti-Reverse Engineering
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
- details
- "patch.exe" is allocating memory with PAGE_GUARD access rights
- source
- API Call
- relevance
- 10/10
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
-
Environment Awareness
-
Reads the active computer name
- details
- "patch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
- source
- Registry Access
- relevance
- 5/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Reads the cryptographic machine GUID
- details
- "patch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
- source
- Registry Access
- relevance
- 10/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Tries to sleep for a long time (more than two minutes)
- details
- "patch.exe" sleeping for "1566804069" milliseconds
- source
- API Call
- relevance
- 10/10
-
Reads the active computer name
-
General
-
Reads configuration files
- details
- "patch.exe" read file "%WINDIR%\win.ini"
- source
- API Call
- relevance
- 4/10
-
Reads configuration files
-
Installation/Persistence
-
Monitors specific registry key for changes
- details
- "patch.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 0)
- source
- API Call
- relevance
- 4/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Monitors specific registry key for changes
-
Network Related
-
Detected increased number of ARP broadcast requests (network device lookup)
- details
- Attempt to find devices in networks: "192.168.240.2/32, 192.168.240.142/32, 192.168.242.40/32, 192.168.243.23/32, 192.168.243.42/32, ..."
- source
- Network Traffic
- relevance
- 10/10
- ATT&CK ID
- T1046 (Show technique in the MITRE ATT&CK™ matrix)
-
Detected increased number of ARP broadcast requests (network device lookup)
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"patch.exe" wrote bytes "f8110000" to virtual address "0x75AC12CC" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "f811ac75" to virtual address "0x75AD834C" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "f8110000" to virtual address "0x75AC1408" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "b89012fb6effe0" to virtual address "0x75AC1248" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "4812ac75" to virtual address "0x75AD8348" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "f811ac75" to virtual address "0x75AD8368" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "68130000" to virtual address "0x77261680" (part of module "WS2_32.DLL")
"patch.exe" wrote bytes "a011fb6e" to virtual address "0x77A3E324" (part of module "WININET.DLL")
"patch.exe" wrote bytes "f811ac75" to virtual address "0x75AD83C4" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "4812ac75" to virtual address "0x75AD8364" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "c04ed6772054d777e065d777b538d8770000000000d00a7700000000c5ea0a770000000088ea0a7700000000e968ed758228d877ee29d87700000000d269ed75000000007dbb0a770000000009beed7500000000ba180a7700000000" to virtual address "0x77EB1000" (part of module "NSI.DLL")
"patch.exe" wrote bytes "db4d0e6f00000000" to virtual address "0x010C2000" (part of module "PATCH.EXE")
"patch.exe" wrote bytes "4812ac75" to virtual address "0x75AD83C0" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "f811ac75" to virtual address "0x75AD83E0" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "b88011fb6effe0" to virtual address "0x77261368" (part of module "WS2_32.DLL")
"patch.exe" wrote bytes "73d09d5d" to virtual address "0x6A37F798" (part of module "CLR.DLL")
"patch.exe" wrote bytes "48120000" to virtual address "0x75AC139C" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "48120000" to virtual address "0x75AC12DC" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "4812ac75" to virtual address "0x75AD83DC" (part of module "SSPICLI.DLL")
"patch.exe" wrote bytes "b81015fb6effe0" to virtual address "0x75AC11F8" (part of module "SSPICLI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Reads information about supported languages
- details
- "patch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
- source
- Registry Access
- relevance
- 3/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
-
Hiding 1 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version
-
Informative 10
-
General
-
Contains PDB pathways
- details
-
"C:\code32\Mains\dfxui\dfxui\Win32\MtStaticRt\dfxui.pdb"
"%USERPROFILE%\documents\visual studio 2015\Projects\FXSound Enchanter Patch (TtechCracks)\FXSound Enchanter Patch (TtechCracks)\obj\Debug\FXSound Patch (TtechCracks).pdb" - source
- File/Memory
- relevance
- 1/10
-
Contains SQL queries
- details
-
"UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;"
"UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');"
"UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;"
"INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);"
"SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0"
"SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'"
"SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" - source
- File/Memory
- relevance
- 2/10
-
Loads rich edit control libraries
- details
- "patch.exe" loaded module "%WINDIR%\System32\riched20.dll" at 660F0000
- source
- Loaded Module
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Loads the .NET runtime environment
- details
- "patch.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 68F60000
- source
- Loaded Module
-
Contains PDB pathways
-
Installation/Persistence
-
Connects to LPC ports
- details
- "patch.exe" connecting to "\ThemeApiPort"
- source
- API Call
- relevance
- 1/10
-
Touches files in the Windows directory
- details
-
"patch.exe" touched file "%WINDIR%\AppPatch\sysmain.sdb"
"patch.exe" touched file "C:\Windows\AppPatch\AcGenral.dll"
"patch.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
"patch.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll"
"patch.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"
"patch.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll"
"patch.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll"
"patch.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"
"patch.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll"
"patch.exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll"
"patch.exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config"
"patch.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux"
"patch.exe" touched file "C:\Windows\assembly\pubpol247.dat"
"patch.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll.aux"
"patch.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll.aux"
"patch.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll.aux" - source
- API Call
- relevance
- 7/10
-
Connects to LPC ports
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "FXSound_Enchanter_Patch__TtechCracks_.My"
Pattern match: "www.digicert.com1+0"
Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0"
Pattern match: "crl3.digicert.com/EVCodeSigningSHA2-g1.crl07"
Pattern match: "crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K"
Pattern match: "https://www.digicert.com/CPS0"
Pattern match: "http://ocsp.digicert.com0H"
Pattern match: "http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0"
Pattern match: "www.digicert.com1!0"
Pattern match: "crl3.digicert.com/DigiCertAssuredIDCA-1.crl08"
Pattern match: "crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w"
Pattern match: "http://ocsp.digicert.com0A"
Pattern match: "cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0"
Pattern match: "http://ocsp.digicert.com0I"
Pattern match: "http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0"
Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@"
Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0"
Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0"
Pattern match: "www.digicert.com1$0"
Pattern match: "http://ocsp.digicert.com0C"
Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0"
Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0"
Pattern match: "crl4.digicert.com/DigiCertAssuredIDRootCA.crl0"
Pattern match: "https://www.fxsound.com"
Pattern match: "http://cgi.fxsound.com/~fxsound/cgi-bin/install_email.cgi"
Pattern match: "http://dv.api.fxsound.com/services/fxsound/"
Pattern match: "http://api.fxsound.com/services/fxsound/"
Pattern match: "http://www.exploretunes.com/?noautostart=1"
Pattern match: "http://www.fxsound.com/cgi_php/password.php"
Pattern match: "http://updates.fxsound.com/announce?vendor=%d&subvendor=%d&version=%.3f&demo=%d"
Pattern match: "http://www.fxsound.com" - source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"TwitterHover.bmp" (Indicator: "twitter")
"YouTubeHover.bmp" (Indicator: "youtube") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
System Security
-
Opens the Kernel Security Device Driver (KsecDD) of Windows
- details
- "patch.exe" opened "\Device\KsecDD"
- source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
Opens the Kernel Security Device Driver (KsecDD) of Windows
-
Unusual Characteristics
-
Matched Compiler/Packer signature
- details
- "fac6f01b2c69c34a913e2195818a92ee5c0c4abd0da05cac7b2d6208496b84d4.bin" was detected as "Microsoft visual C# v7.0 / Basic .NET"
- source
- Static Parser
- relevance
- 10/10
- ATT&CK ID
- T1045 (Show technique in the MITRE ATT&CK™ matrix)
-
Matched Compiler/Packer signature
File Details
patch.exe
- Filename
- patch.exe
- Size
- 1.8MiB (1851392 bytes)
- Type
- peexe assembly executable
- Description
- PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
- Architecture
- WINDOWS
- SHA256
- fac6f01b2c69c34a913e2195818a92ee5c0c4abd0da05cac7b2d6208496b84d4
- MD5
- abaf3c5cdba70900f9d89fbb425bd2eb
- SHA1
- 4de092865c9cb21c0daed460269f2b7c427619ba
- ssdeep
-
24576:Z8jr43v4/E8kqk76yvsWn4+Ee1VsPB3djVXIN1aWcX77+mnhNphy:KP88uHG5dj61qH+mnhzhy
- imphash
-
f34d5f2d4577ed6d9ceec516c1f5a744
- authentihash
-
97d0b60a4fc4321883c0ffa6315d693cfac07e3a381bd65036ba54a41f6d5894
- Compiler/Packer
- Microsoft visual C# v7.0 / Basic .NET
- PDB Timestamp
- 09/01/2020 17:37:32 (UTC)
- PDB Pathway
- C:\Users\Thierry\documents\visual studio 2015\Projects\FXSound Enchanter Patch (TtechCracks)\FXSound Enchanter Patch (TtechCracks)\obj\Debug\FXSound Patch (TtechCracks).pdb
- PDB GUID
- 369EF495F640441F92BF535B868B3983
Version Info
- Translation
- 0x0000 0x04b0
- LegalCopyright
- Copyright 2020
- Assembly Version
- 1.0.0.0
- InternalName
- FXSound Patch (TtechCracks).exe
- FileVersion
- 1.0.0.0
- CompanyName
- -
- LegalTrademarks
- -
- Comments
- -
- ProductName
- FXSound Enchanter Patch (TtechCracks)
- ProductVersion
- 1.0.0.0
- FileDescription
- FXSound Enchanter Patch (TtechCracks)
- OriginalFilename
- FXSound Patch (TtechCracks).exe
Classification (TrID)
- 40.0% (.OCX) Windows ActiveX control
- 25.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.)
- 14.8% (.EXE) InstallShield setup
- 9.5% (.EXE) Win64 Executable (generic)
- 4.5% (.SCR) Windows screen saver
File Sections
| Details | ||||||
|---|---|---|---|---|---|---|
File Resources
| Details | ||||
|---|---|---|---|---|
File Imports
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
-
patch.exe
(PID: 2828)
4/70
Network Analysis
DNS Requests
No relevant DNS requests were made.
Contacted Hosts
No relevant hosts were contacted.
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
No significant files were extracted.
Notifications
-
Runtime
- Network whitenoise filtering was applied
- Not all IP/URL string resources were checked online
- Not all sources for indicator ID "api-55" are available in the report
- Not all sources for indicator ID "network-32" are available in the report
- Not all sources for indicator ID "string-64" are available in the report