Resubmissions

04-04-2023 12:05

230404-n9ekyagf3s 10

04-04-2023 12:01

230404-n7b22age9v 6

General

  • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqazI3SXc1Wi05dnEwQTFZTXZDZkJjQ29aWjZxQXxBQ3Jtc0ttTE90eGhIVTF6UUJUOUduME1ka3ZkWmIxd1dxalJpVFRRVEFXbUZzS3BLRkplampJM0FKSFAwdUd6SW1sS1JrQ0NuQVJiZFYwdXZ4N0xoNk5wemQxUmFXaVRsRVV0UHdVcFA2MHlmNk5KcWZLd00xaw&q=https%3A%2F%2Fgetcrackapp.net%2FAvastPremiumSecurity&v=XIbiGD_7xSU

  • Sample

    230404-n9ekyagf3s

Malware Config

Extracted

Path

C:\Program Files\Avast Software\Avast\gui_resources\default_av\aswbf3958c91043c863.tmp

Ransom Note
{"batterySaver.notInstalled.btn":"$t(global.upgrade)","batterySaver.installed.btn":"$t(global.open)","batterySaver.installed.title":"$t(batterySaver.caption)","antiransomware_wordbreak":"$t(antiransomware)","deepProtect.tryToReconnect":"$t(deepProtect.onboarding.browser.tryAgain)","security":"$t(protection)","global.product.ASB":"Avast Secure Browser","global.product.one_pro":"$t(global.product.one)","global.product.one_free":"$t(global.product.one) Essential","global.product.one":"Avast One","global.product.usr":"$t(global.product.ssp)","global.product.dsr":"$t(global.product.ssp)","global.product.ssr":"$t(global.product.ssp)","global.product.usp":"$t(global.product.ssp)","global.product.dsp":"$t(global.product.ssp)","global.product.ssp":"Avast Business Security","global.buyNow":"$t(dashboard.problems.expiring.trial.action)","global.renewNow":"$t(dashboard.problems.expiring.action)","product":"$t(global.avast)","passwords.settings.importExport.import.btn":"$t(global.import)","secureline":"$t(global.secureline)","softwarehealth_wordbreak":"$t(softwarehealth)","antiTrack.ss.oldCookiesGeneric.detail.title":"$t(antiTrack.ss.oldCookies.title)","bex.aos.title":"Avast Online Security & Privacy","bex.sending.error":"$t(feedbackForm.sending.error)","bex.errorRestoreModal.title":"$t(viruschest.errorRestoreModal.title)","darkWebMonitor.breach.detail.more":"$t(global.learnMore)","darkWebMonitor_wordbreak":"$t(darkWebMonitor)","dashboard.problems.awaiting_payment.desc":"$t(dashboard.premium.suspended.desc)","dashboard.problems.awaiting_payment":"$t(dashboard.premium.suspended.title)","dashboard.problems.browserprotection_shield_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.browserprotection_shield_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.datascan_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.datascan_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.securedns_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.securedns_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.remote_access_shield_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.remote_access_shield_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.webcamshield_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.webcamshield_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.antiransomwareshield_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.behavshield_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.webshield_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.mailshield_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.fsshield_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.antiransomwareshield_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.behavshield_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.webshield_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.mailshield_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.fsshield_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.shields_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.service_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.self_defense_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.arpot_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.arpot_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.antiexploit_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.antiexploit_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.passive_mode_locked.action":"$t(dashboard.problems.passive_mode.action.general)","dashboard.problems.passive_mode_manual.action":"$t(dashboard.problems.passive_mode.action.general)","dashboard.problems.passive_mode.action":"$t(dashboard.problems.passive_mode.action.general)","dashboard.problems.passive_mode_manual.desc":"$t(dashboard.problems.passive_mode.desc.general)","dashboard.problems.passive_mode.desc":"$t(dashboard.problems.passive_mode.desc.general)","dashboard.problems.passive_mode_manual":"$t(dashboard.problems.passive_mode.general)","dashboard.problems.passive_mode":"$t(dashboard.problems.passive_mode.general)","dashboard.problems.firewall_off.desc":"$t(dashboard.problems.shield_off.desc)","dashboard.problems.firewall_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.autoupdate_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.antispam_off.action":"$t(dashboard.problems.turnon.action)","dashboard.problems.some_shields_off.action":"$t(dashboard.problems.turnon.action)","datashredder.filename":"$t(global.fileName)","detection.status.chest":"$t(viruschest.movedTo)","detection.action.chest.progress":"$t(viruschest.movingTo)","detection.action.chest":"$t(viruschest.moveTo)","detection.threat.type.3.0":"$t(detection.threat.type.3.7)","detection.threat.type.2.0":"$t(detection.threat.type.2.3)","detection.threat.type.1.0":"$t(detection.threat.type.1.19)","firewall.noRuleBehaviour.autodecide.label":"$t(firewall.smartMode)","firewall.app":"$t(global.app)","global.showLess":"$t(global.show.less)","global.product.premier":"$t(global.product.premiumSecurity)","global.installedAppName":"$t(global.appName)","global.product.avg_business":"Business","global.vpn.short.brand":"$t(global.secureline)","global.vpn.brand":"$t(global.brand) $t(global.secureline)","global.cleanup.brand":"$t(global.brand) Cleanup Premium","global.brand":"$t(global.avast)","global.product.avg_paid":"Internet Security","privacyIssues.ss2.isp.desc2.AB.5":"$t(privacyIssues.ss2.isp.desc2.AB.2)","privacyIssues.ss2.isp.desc1.AB.5":"$t(privacyIssues.ss2.isp.desc1.AB.1)","privacyIssues.ss2.visibleOnline.desc1.AB.5":"$t(privacyIssues.ss2.visibleOnline.desc1.AB.4)","privacyIssues.ss2.publicIp.desc.AB.5":"$t(privacyIssues.ss2.publicIp.desc.AB.1)","privacyIssues.ss2.knownLocation.desc.AB.5":"$t(privacyIssues.ss2.knownLocation.desc.AB.1)","privacyIssues.ss2.knownLocation.desc1.AB.4":"$t(privacyIssues.ss2.knownLocation.desc1.AB.1)","privacyIssues.ss2.publicIp.desc1.AB.4":"$t(privacyIssues.ss2.publicIp.desc1.AB.1)","privacyIssues.ss2.isp.desc2.AB.4":"$t(privacyIssues.ss2.isp.desc2.AB.2)","privacyIssues.ss2.isp.desc1.AB.4":"$t(privacyIssues.ss2.isp.desc1.AB.1)","privacyIssues.ss2.publicIp.desc.AB.4":"$t(privacyIssues.ss2.publicIp.desc.AB.1)","privacyIssues.ss2.knownLocation.desc.AB.4":"$t(privacyIssues.ss2.knownLocation.desc.AB.1)","privacyIssues.ss2.publicIp.desc1.AB.3":"$t(privacyIssues.ss2.publicIp.desc1.AB.1)","privacyIssues.ss2.knownLocation.desc1.AB.2":"$t(privacyIssues.ss2.knownLocation.desc1.AB.1)","privacyIssues.ss2.publicIp.desc1.AB.2":"$t(privacyIssues.ss2.publicIp.desc1.AB.1)","privacyIssues.ss2.isp.desc1.AB.2":"$t(privacyIssues.ss2.isp.desc1.AB.1)","privacyIssues.ss2.visibleOnline.desc1.AB.2":"$t(privacyIssues.ss2.visibleOnline.desc1.AB.1)","privacyIssues.ss2.publicIp.desc.AB.2":"$t(privacyIssues.ss2.publicIp.desc.AB.1)","privacyIssues.ss2.knownLocation.desc.AB.2":"$t(privacyIssues.ss2.knownLocation.desc.AB.1)","privacyIssues.ss2.visibleOnline.desc.AB.2":"$t(privacyIssues.ss2.visibleOnline.desc.AB.1)","scanAdvancedThreats.weakFirewall.detail.desc.AB.5":"$t(scanAdvancedThreats.weakFirewall.detail.desc.AB.2)","scanAdvancedThreats.webcamRunningIssue.detail.desc.AB.5":"$t(scanAdvancedThreats.webcamRunningIssue.detail.desc.AB.2)","scanAdvancedThreats.rswSdsCombined.detail.desc.AB.5":"$t(scanAdvancedThreats.rswSdsCombined.detail.desc.AB.4)","scanAdvancedThreats.rswSdsCombined.desc.AB.5":"$t(scanAdvancedThreats.rswSdsCombined.desc.AB.1)","scanAdvancedThreats.weakFirewall.detail.desc.AB.4":"$t(scanAdvancedThreats.weakFirewall.detail.desc.AB.2)","scanAdvancedThreats.webcamRunningIssue.detail.desc.AB.4":"$t(scanAdvancedThreats.webcamRunningIssue.detail.desc.AB.2)","scanAdvancedThreats.rswSdsCombined.desc.AB.4":"$t(scanAdvancedThreats.rswSdsCombined.desc.AB.1)","scanAdvancedThreats.ss2.results.subtitle.AB.4":"$t(scanAdvancedThreats.ss2.results.subtitle.AB.2)","scanAdvancedThreats.weakFirewall.detail.desc.AB.3":"$t(scanAdvancedThreats.weakFirewall.detail.desc.AB.2)","scanAdvancedThreats.rswSdsCombined.desc.AB.3":"$t(scanAdvancedThreats.rswSdsCombined.desc.AB.1)","scanAdvancedThreats.ss2.results.subtitle.AB.3":"$t(scanAdvancedThreats.ss2.results.subtitle.AB.2)","scanAdvancedThreats.secdnsRunningIssue.desc.AB.2":"$t(scanAdvancedThreats.secdnsRunningIssue.desc.AB.1)","scanAdvancedThreats.rswSdsCombined.desc.AB.2":"$t(scanAdvancedThreats.rswSdsCombined.desc.AB.1)","scanAdvancedThreats.ss2.allResolved.subtitle":"$t(scanAdvancedThreats.ss2.noIssues.subtitle)","scanAdvancedThreats.secdnsRunningIssue.detail.title":"$t(scanAdvancedThreats.secdnsRunningIssue.title)","scanAdvancedThreats.weakFirewall.detail.desc.offerPremiumFeatures":"$t(scanAdvancedThreats.weakFirewall.desc.offerPremiumFeatures)","scanAdvancedThreats.weakFirewall.detail.title.offerPremiumFeatures":"$t(scanAdvancedThreats.weakFirewall.title.offerPremiumFeatures)","scanAdvancedThreats.weakFirewall.detail.title":"$t(scanAdvancedThreats.weakFirewall.title)","scanAdvancedThreats.webcamRunningIssue.detail.desc":"$t(scanAdvancedThreats.webcamRunningIssue.desc)","scanAdvancedThreats.webcamRunningIssue.detail.title":"$t(scanAdvancedThreats.webcamRunningIssue.title)","scanAdvancedThreats.rswSdsCombined.detail.title":"$t(scanAdvancedThreats.rswSdsCombined.title)","scans.detection.openVirusChest":"$t(viruschest.open)","scans.threatAction.chest":"$t(viruschest)","scans.detection.action.chest.progressText":"$t(viruschest.movingTo)","scans.detection.action.chest.label":"$t(viruschest.moveTo)","scans.scanType.custom.caption":"$t(scans.customScans.desc)","scans.scanType.quick.caption":"$t(scans.customScans.desc)","scans.scanType.menu":"$t(scans.scanType.explorer)","scans.scanType.smartScan":"$t(smartscan)","scans.scanning":"$t(global.scanning)","scans.skipModal.title":"$t(scans.leaveModal.title)","settings.troubleshooting.importSettings.confirm.btn":"$t(global.import)","settings.password.protectVirusChest":"$t(viruschest)","settings.update.program.askWhenUpdateAvailable":"$t(settings.update.askWhenUpdateAvailable)","settings.update.vps.askWhenUpdateAvailable":"$t(settings.update.askWhenUpdateAvailable)","settings.fullProtection":"$t(global.fullProtection)","settings.basicProtection":"$t(global.basicProtection)","shields.settings.selectActionVirus.auto.desc":"$t(shields.settings.selectActionUnwantedProgram.auto.desc)","smartscan.ss2.progressBar.scanForUpdates.AB":"$t(smartscan.ss2.progressBar.scanForUpdates)","smartscan.ss2.scanUltimate.results.performance.subtitle":"$t(cleanuppp.ss2.smartscan.subtitle)","smartscan.ss2.scanUltimate.results.privacy.subtitle":"$t(privacyIssues.ss2.results.subtitle)","smartscan.ss2.scanUltimate.results.security.noIssues.subtitle":"$t(scanAdvancedThreats.ss2.noIssues.subtitle)","smartscan.ss2.scanUltimate.results.security.subtitle":"$t(scanAdvancedThreats.ss2.results.subtitle)","smartscan.ss2.scanUltimate.results.noIssues.subtitle":"$t(scanAdvancedThreats.ss2.noIssues.subtitle)","smartscan.ss2.scanUltimate.results.noIssues.title":"$t(scanAdvancedThreats.ss2.noIssues.title)","smartscan.ss2.scanUltimate.results.title":"$t(scanAdvancedThreats.ss2.results.title)","smartscan.ss2.scanUltimate.progress.title":"$t(scanAdvancedThreats.ss2.progress.title)","smartscan.ss2.progressBar.scanUltimate":"$t(smartscan.ss2.progressBar.scanAdvancedThreats)","statistics.openchest":"$t(viruschest.open)","passwordProtection.tooltip.notInstalled":"$t(groups.features.tooltipNotInstalled)","passwordProtection_wordbreak":"$t(passwordProtection)","remoteAccessShield.log.info.desc.blocked.ipInBlackList":"$t(remoteAccessShield.log.info.desc.blocked)","remoteAccessShield_wordbreak":"$t(remoteAccessShield)","antiTrack.installing.info":"It will open automatically when done.","antiTrack.installing":"AntiTrack Premium is now installing...","antiTrack.open":"Open AntiTrack","antiTrack.content.text":"Disguise your online identity<br/>for greater privacy.","antiTrack.content.title":"Get advertisers off your back.","antiTrack.caption":"Stop ad tracking","upsell.desc.webcam":"Prevent hackers and untrusted apps from hijacking your<br>webcam to spy on you.","upsell.desc.sensitiveData":"Scan your PC for documents containing private info and<br>secure them against unauthorized access.","upsell.desc.dataShredder":"Keep your secrets safe by permanently deleting sensitive files once<br>you’re done with them.","upsell.desc.realSite":"Avoid fake websites so you don’t unwittingly give thieves<br>your passwords and bank details.","upsell.desc.sandbox":"Test suspicious files in a safe environment to prevent them from wreaking<br>havoc on your PC.","upsell.desc.firewall":"Keep hackers on the other side of the wall by controlling what<br>goes in and out of your PC.","batterySaver.notInstalled.desc":"Stop computer processes that drain excessive amounts of power to extend your battery life up to 32&percnt;.","batterySaver.notInstalled.title":"Upgrade now to unlock this feature","batterySaver.installed.desc":"Stop computer processes that drain excessive amounts of power to extend your battery life.","batterySaver.caption":"Boost your battery life","batterySaver":"Battery Saver","about.copyright":"Copyright &copy; 1988 - 2022 Avast Software s.r.o. All rights reserved.<br />Avast is a registered trademark of Avast Software s.r.o.","about.programVersion":"Program version","antiransomware.stopProtectingFolder.desc":"Ransomware Shield will stop protecting all the files in this folder.","antiransomware.stopProtectingFolders.desc":"Ransomware Shield will stop protecting all the files in this folder.","antiransomware.stopProtectingFolders.desc_plural":"Ransomware Shield will stop protecting all files in these folders.","antiransomware.cannotAdd.desc":"Ransomware Shield is designed to protect personal folders. System folders, network folders, and removable devices are not currently supported.","antiransomware.inactive.tooltip":"Turn on Ransomware Shield to protect your files","antiransomware":"Ransomware Shield","antispam.desc":"Block spam and malicious phishing emails for a safer, cleaner inbox.","antispam":"Anti-spam","dashboard.problems.awaiting_payment.action":"Renewal options","dashboard.problems.securedns_off":"<span>Real Site</span> is turned off","dashboard.problems.antiransomwareshield_off":"<span>Ransomware Shield</span> is turned off","dashboard.problems.behavshield_off":"<span>Behavior Shield</span> is turned off","dashboard.problems.webcamshield_off":"<span>Webcam Shield</span> is turned off","dashboard.problems.mailshield_off":"<span>Mail Shield</span> is turned off","dashboard.finishingInstallation":"Avast installation is finishing","dashboard.problems.version_ok":"Everything is up-to-date. Nice!","dashboard.problems.subscription_free_expired":"<span>Avast Free Antivirus</span> has expired","dashboard.problems.subscription_free.action":"Please register your Avast","dashboard.problems.subscription_free":"Your Avast license has expired.","dashboard.problems.subscription_business":"Your Avast license has expired.","dashboard.problems.self_defense_off.desc":"Turn this on to prevent malware from disabling your Avast antivirus.","dashboard.problems.self_defense_off":"<span>Self-Defense</span> is turned off","dashboard.problems.reboot_required.desc":"Avast is still protecting you, but you should restart your computer as soon as possible.","dashboard.problems.firewall_off":"<span>Firewall</span> is turned off","dashboard.problems.autoupdate_off.desc":"You may be missing out on the latest versions of Avast.","dashboard.status.fullProtection":"<span>You are</span> fully protected.","dashboard.status.basicProtection":"<span>You have</span> basic protection.","datashredder.desc":"Protect your secrets by permanently and securely deleting<br>individual files or whole drives so they can’t be recovered.","datashredder.filesForShredding":"%s file ready for shredding","datashredder.filesForShredding_plural":"%s files ready for shredding","deepProtect.tooltip.s

Targets

    • Target

      https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqazI3SXc1Wi05dnEwQTFZTXZDZkJjQ29aWjZxQXxBQ3Jtc0ttTE90eGhIVTF6UUJUOUduME1ka3ZkWmIxd1dxalJpVFRRVEFXbUZzS3BLRkplampJM0FKSFAwdUd6SW1sS1JrQ0NuQVJiZFYwdXZ4N0xoNk5wemQxUmFXaVRsRVV0UHdVcFA2MHlmNk5KcWZLd00xaw&q=https%3A%2F%2Fgetcrackapp.net%2FAvastPremiumSecurity&v=XIbiGD_7xSU

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

    • Windows security modification

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

3
T1060

Bootkit

1
T1067

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

5
T1112

Disabling Security Tools

1
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

8
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

7
T1082

Security Software Discovery

1
T1063

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Tasks