312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94

General

Target

AntivirusPro2017.exe
Size

816KB
MD5

7dfbfba1e4e64a946cb096bfc937fbad
SHA1

9180d2ce387314cd4a794d148ea6b14084c61e1b
SHA256

312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94
SHA512

f47b05b9c294688811dd72d17f815cce6c90f96d78f6835804d5182e2f4bfbd2d6738de854b8a79dea6345f9372ba76a36920e51e6cb556ef4b38b620e887eb4
SSDEEP

12288:De/2dxVZ+ivtwdeOkD5YNfEp5UOc1+A4cMfZIYMlBlfwFyfr7BM9G/9V:6/iBFSkyNfI51cQFhMlvIofZRn

Score

7^/10

bootkit persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AntivirusPro2017.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows\CurrentVersion\Run	AntivirusPro2017.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiVirus Pro 2017 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AntivirusPro2017.exe"	AntivirusPro2017.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AntivirusPro2017.exe

description	ioc	process
File opened (read-only)	\??\E:	AntivirusPro2017.exe
File opened (read-only)	\??\K:	AntivirusPro2017.exe
File opened (read-only)	\??\Q:	AntivirusPro2017.exe
File opened (read-only)	\??\S:	AntivirusPro2017.exe
File opened (read-only)	\??\T:	AntivirusPro2017.exe
File opened (read-only)	\??\V:	AntivirusPro2017.exe
File opened (read-only)	\??\F:	AntivirusPro2017.exe
File opened (read-only)	\??\J:	AntivirusPro2017.exe
File opened (read-only)	\??\L:	AntivirusPro2017.exe
File opened (read-only)	\??\M:	AntivirusPro2017.exe
File opened (read-only)	\??\U:	AntivirusPro2017.exe
File opened (read-only)	\??\W:	AntivirusPro2017.exe
File opened (read-only)	\??\Z:	AntivirusPro2017.exe
File opened (read-only)	\??\O:	AntivirusPro2017.exe
File opened (read-only)	\??\Y:	AntivirusPro2017.exe
File opened (read-only)	\??\G:	AntivirusPro2017.exe
File opened (read-only)	\??\H:	AntivirusPro2017.exe
File opened (read-only)	\??\I:	AntivirusPro2017.exe
File opened (read-only)	\??\N:	AntivirusPro2017.exe
File opened (read-only)	\??\P:	AntivirusPro2017.exe
File opened (read-only)	\??\R:	AntivirusPro2017.exe
File opened (read-only)	\??\X:	AntivirusPro2017.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

AntivirusPro2017.exe

description ioc process

File opened for modification \??\PhysicalDrive0 AntivirusPro2017.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AntivirusPro2017.exe

pid process

4344 AntivirusPro2017.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	AntivirusPro2017.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

AntivirusPro2017.exe

pid	process
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

AntivirusPro2017.exe

pid	process
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe
4344	AntivirusPro2017.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AntivirusPro2017.exe

pid process

4344 AntivirusPro2017.exe
4344 AntivirusPro2017.exe

C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.exe
"C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4344-133-0x0000000000B90000-0x0000000000B91000-memory.dmp

Filesize
4KB

Download
memory/4344-134-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-135-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/4344-136-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-137-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/4344-138-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-139-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-140-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-141-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-142-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-143-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-144-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-145-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-146-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-147-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-148-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-149-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/4344-150-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads