aee69ef9040e902b7a6639d7594df47e0e73625143a671583db8b85be525a3e5

Resubmissions

02/03/2024, 22:38

240302-2kwptaae3710

02/03/2024, 22:34

240302-2g86qsad9610

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fake AV/NavaShield.exe
Size 9.7MB
Sample240302-2g86qsad96
SHA256 83ecb875f87150a88f4c3d496eb3cb5388cd8bafdff4879884ececdbd1896e1d
MD5 1f13396fa59d38ebe76ccc587ccb11bb
SHA1 867adb3076c0d335b9bfa64594ef37a7e2c951ff
SHA512 82ca2c781bdaa6980f365d1eedb0af5ac5a80842f6edc28a23a5b9ea7b6feec5cd37d54bd08d9281c9ca534ed0047e1e234873b06c7d2b6fe23a7b88a4394fdc
SSDEEP 196608:CtbTP1ErBwMQjd1YTHdmpCP2PVgP/acIE/xQ0zyZejVk+YzbRdTZ:C1E1+dYx6OP9hdyZwV4zd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2012	NavaShield.exe
436	NavaBridge.exe
1560	NavaDebugger.exe

Loads dropped DLL 11 IoCs

pid	Process
2212	NavaShield.exe
2012	NavaShield.exe
2012	NavaShield.exe
2012	NavaShield.exe
2012	NavaShield.exe
2012	NavaShield.exe
436	NavaBridge.exe
436	NavaBridge.exe
436	NavaBridge.exe
2012	NavaShield.exe
1560	NavaDebugger.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\NavaShield = "c:\\Nava Labs\\Nava Shield\\navashield.exe"	NavaShield.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	NavaShield.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	NavaShield.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	NavaShield.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2012	NavaShield.exe
2012	NavaShield.exe
2012	NavaShield.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2012	NavaShield.exe
2012	NavaShield.exe
2012	NavaShield.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2012	2212	NavaShield.exe	30
PID 2212 wrote to memory of 2012	2212	NavaShield.exe	30
PID 2212 wrote to memory of 2012	2212	NavaShield.exe	30
PID 2212 wrote to memory of 2012	2212	NavaShield.exe	30
PID 2012 wrote to memory of 436	2012	NavaShield.exe	32
PID 2012 wrote to memory of 436	2012	NavaShield.exe	32
PID 2012 wrote to memory of 436	2012	NavaShield.exe	32
PID 2012 wrote to memory of 436	2012	NavaShield.exe	32
PID 2012 wrote to memory of 1560	2012	NavaShield.exe	33
PID 2012 wrote to memory of 1560	2012	NavaShield.exe	33
PID 2012 wrote to memory of 1560	2012	NavaShield.exe	33
PID 2012 wrote to memory of 1560	2012	NavaShield.exe	33

C:\Users\Admin\AppData\Local\Temp\Fake AV\NavaShield.exe
"C:\Users\Admin\AppData\Local\Temp\Fake AV\NavaShield.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Nava Labs\Nava Shield\NavaShield.exe
  "C:\Nava Labs\Nava Shield\NavaShield.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Nava Labs\Nava Shield\NavaBridge.exe
    "C:\Nava Labs\Nava Shield\NavaBridge.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:436
- - C:\Nava Labs\Nava Shield\NavaDebugger.exe
    "C:\Nava Labs\Nava Shield\NavaDebugger.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NavaBridge.exe

Path C:\Nava Labs\Nava Shield\NavaBridge.exe
Size 4.0MB
SHA256 e7f05380e90dfb15b91b8bbc2ae48a04ba84d573b3c9f7d81bcc12f814215929
MD5 6f89df4cde193c0636c3d497cf1a17bf
SHA1 9faaa0100195e3e81fdade11e7a476a1fd1b23c8
SHA512 c31848b1dceb8f8351991051b389a38b2ca0ae7ee98ebf626576245ca1588f1f6ee14e3eff7b165ecf9879e7e11ab77888e297cc4ccbb405b0ed64ebcda304b2
SSDEEP 49152:2Qex84rvg4fNdqaekoMS0BRAlfTcewuMva0NchhBAcThWoau9/v8y8SlQnsjI2wz:L4a0NIXCrkQN17pP
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaBridge.exe

Path C:\Nava Labs\Nava Shield\NavaBridge.exe
Size 2.1MB
SHA256 3613e118d87531b4357b014f23a08551339962a3e0e5cfbdfbca7f989e145848
MD5 57665e9b4d766001862c38bde736f965
SHA1 05966b1b04e2e2f9e018d8b55f7b589d29d3ddbd
SHA512 6759bb36ebe8316bfbc17ca5fead431813a6aa2accecfa1391c041f8ac50e78ab1f88b5bfc5016fe4e337c32c73d97165d6431d63e84e072fac1a29c015f1872
SSDEEP 49152:2Qex84rvg4fNdqaekoMS0BRAlfTcewuMva0NchhBAcThWoau9/v8y8SlQnsjI2wv:L4a0NIXCrkQt
MD5 SHA1 SHA512 SSDEEP

Submit Download

MD5.dll

Path C:\Nava Labs\Nava Shield\NavaDebugger Libs\MD5.dll
Size 92KB
SHA256 8341ecc0938ca6d90b7e0f02af2d7e6b571c948a03a99d54af61c4557c78d656
MD5 831295342c47b770bf7cc591a6916fa7
SHA1 2c9063fbf3f3363526abdc241bf90618b82446d1
SHA512 01419defe963a987989cddb0e21cf651ec3eefeae97cf4b257d4caa8da26436a647e8e4d95cdad22bbb0657171f6d3d9c41dc6fb217ffc7d5172ebc9a409d36e
SSDEEP 768:RL2roNiodgYJVLc5x8hSq5seR7y0LZdg4GXRxkdx4lKvi7OPYntGDa3V7:RL3UoxJVLc5xPwRdLf6K67Oiti
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaDebugger.exe

Path C:\Nava Labs\Nava Shield\NavaDebugger.exe
Size 2.1MB
SHA256 7f9b0554775bbb6996de3a20038a08485fc8a211e0a4bb0aa055c3767339d00a
MD5 09e1f0733eb59abeb9180cd8db034053
SHA1 209c79c4eca9f4a8ea5ed78561a76c6fc4ecdef8
SHA512 515ff6df7d80fd81d0c7b3fb8ca64b29eeed5beb3dc42f14c6b17f4dc788e2d75e5df88273e151cb01cb92875eefb314219e48de9991ba4f8a76b0602bc7d532
SSDEEP 49152:2Qex84rvg4fNdqaekoMS0BRAlfTcewuMva0NchhBAcThWoau9/v8y8SlQnsjI2wz:L4a0NIXCrkQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaDebugger.exe

Path C:\Nava Labs\Nava Shield\NavaDebugger.exe
Size 2.3MB
SHA256 8ede8bbfdd719b86bf6c949412b86ef7ba7573596772a8f506e74c2c04ce430b
MD5 9111d2f189927c7b49f49d3e2068cb68
SHA1 ccb60935e474978efd8e7737d660f77be7720366
SHA512 3364416cdb9c7f276e1dd167b1cacf3ec964aac24c3cb1cd160a4e64435ccaed4331486be5c55172f83c2eab5b25ebb05816ada7f81085c68fa3eeee3306f4aa
SSDEEP 49152:2Qex84rvg4fNdqaekoMS0BRAlfTcewuMva0NchhBAcThWoau9/v8y8SlQnsjI2wo:L4a0NIXCrkQF1C
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaDebugger.exe

Path C:\Nava Labs\Nava Shield\NavaDebugger.exe
Size 3.4MB
SHA256 58d1784dbac1819d0dd11c60987f4442c99ea71fe8f9522a8299b3cff869194e
MD5 ca349faf9fbed80c3eeb0c5735aad99c
SHA1 4707cd4b771f6c1783c492d1214f1e9e6a5551bc
SHA512 4afb559f861053cb0352cf0d7bb69cfbc64e1c8565fd9fb8e53e3618a089da447f12da9b99626fbe16bf35c64147c4990eba3e601023c26bf53ea44876023bc3
SSDEEP 49152:2Qex84rvg4fNdqaekoMS0BRAlfTcewuMva0NchhBAcThWoau9/v8y8SlQnsjI2wG:L4a0NIXCrkQF1xa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Internet Encodings.dll

Path C:\Nava Labs\Nava Shield\NavaShield Libs\Internet Encodings.dll
Size 72KB
SHA256 a50e56dfb68410a7927ecd50f55044756b54868e920e462671162d1961bfe744
MD5 de5eefa1b686e3d32e3ae265392492bd
SHA1 7b37b0ac1061366bf1a7f267392ebc0d606bb3db
SHA512 c71270a5275f91214444449be4923a70243a9e2cd06afcc6fd28ab9f2cd2d930219ce8ed9ec008750b2611b62ed26b65cb57a75c6035201cd9657263d157d508
SSDEEP 768:WUdOtOXf9NaR0WdK2B2aPqmsVTGiNkD4Pi6FV/GOZtuGwFV:pOIf9k1K2B2S4rq4fFV/ftupV
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaShield.exe

Path C:\Nava Labs\Nava Shield\NavaShield.exe
Size 844KB
SHA256 b5f836905e10c181a2c1d089765a0de51fc6b7b6883b4dcd78633b8d26a6e141
MD5 49d7c9b8aabdde050324079d80855763
SHA1 da9aefeae29148f92181f2303ef5804caab67779
SHA512 5861e3b1d192f8fa580fdb8cdf8716a27b134b87668e838486a6f48192f0c4052ee63379402d6c48940501c8dea66de48b41fefbff34ac736f5bde9fc177a3d7
SSDEEP 24576:HNsj8ESr2/ezS37xKNVLNpP0BrvTk4fNdqu5GpmZoMS0ySCAwaAlfTcewuMv5A05:2Qex84rvg4fNdqaekoMS0BRAlfTcewua
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaShield.exe

Path C:\Nava Labs\Nava Shield\NavaShield.exe
Size 632KB
SHA256 b956e0149d07163bcf85131b671267698321c5590e5e3b1a853be0d69adf3fbb
MD5 90fff0b193fd143b5b435cfd0604c2a6
SHA1 f48f79f814ea2a3c9b368004ec05aaa3c86c6839
SHA512 d7bd9ca480dc03523d40a4f7533ea57db37ce603d2eb9609184284894014b1a976dc49ffa9b57650e9147367ceedcbd70fa2c2a3c87211a0b0a6945653c09aae
SSDEEP 12288:HNj3JSj4XUAESr2/ezS37xKNVLNZ7zOG0BrvTuCe4fNdqt/I5GPxmZupJMS0T2S+:HNsj8ESr2/ezS37xKNVLNpP0BrvTk4fe
MD5 SHA1 SHA512 SSDEEP

Submit Download

bridge.dat

Path C:\Nava Labs\Nava Shield\bridge.dat
Size 176B
SHA256 45fa6eacea58e682c2ef2bb9e888cb6bf396c37b957fd144ca73c95699ad3c74
MD5 e66f1107f995d52bcd90421b3cdc0dde
SHA1 245acafa2f3dab3f2b7f183d34267dcd976199c0
SHA512 0500f9dec5cfdfb80bc5763943deb3111ccde4b35f19ac124df2e5abde2681154977f160a42e9ef50698b0ea0cc26fc09361a3917534038f141dd047f0287c1f
MD5 SHA1 SHA512

Submit Download

config.dat

Path C:\Nava Labs\Nava Shield\config.dat
Size 4KB
SHA256 5993325acfe309946c176737a019aa16e22b921fa6387b766bf8bc8a504e220d
MD5 389bf6e15ae0a7250f454da52aa7ced5
SHA1 1f6a6fe568a1b863bf1f8a9bec9fc8a67e04ca43
SHA512 74bf5a1b5aaa4a27777ef98744aa5a4aac9dc2d64def7be42883d965e77c06852b8bd61c9b7620030c0b5d712ddefdbf0786d0696f62459e33a0debfbc62eb22
SSDEEP 96:g9qbNDuOZbuK/7FLM9wBRgaY1WtZJWMl4Bwtg609G9n/Lw5vk9I:gM3buy4m8Y8MaBwttqGJjgAI
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.dat

Path C:\Nava Labs\Nava Shield\config.dat
Size 4KB
SHA256 6150381c68bdf45a6ce9cf13135dce19886ffd0c252d4b8a0a2ef6d5a983eb47
MD5 059404ab16e140325da96b8cf871eb0f
SHA1 a042d03a013ccea427fa9d776801efd54b2862d8
SHA512 fe1472d39f13228c5734a2ab29ba343571cf67df5dc844a1b828806649a6b734d226484e408d0376140670641950d257f0cdf617efbbec39043509088d250874
SSDEEP 96:gRlKORZPC7q6DgaGt9wiFkjbNj1WSt9PJj+JlEwLlBw9fUgnTHt9v:cXcjs1tmmlSt9cJlEwLTgLLD
MD5 SHA1 SHA512 SSDEEP

Submit Download

navig.dat

Path C:\Nava Labs\Nava Shield\navig.dat
Size 255B
SHA256 9c4723ecb77e39e58eda9c60f532724aa3bf69de30047cc7b6522534cd423f00
MD5 0bf850cb9d0aa0f4c778cc515b79bd13
SHA1 c0cb8a58cba046d2c7539025a39c8a1af81c3914
SHA512 649c13f9f4fccc03ebd6cb2c3752434c69b5a8d7e9b94cac80cd98a7624bfd00648949b18cd720faf89fae050f6b523221db589a550c6ce4513e76ff0895da5b
MD5 SHA1 SHA512

Submit Download

0001.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp
Size 679KB
SHA256 55ea4da6d3f5582a187942aba0a08555c4770731baf3557556aec63edbaf4415
MD5 69ae1881260e0f7870e0e5508f34a502
SHA1 435c610d639c63b1a8e8a4ffd2188d0c47b155b3
SHA512 5232958fff6b2f2cf012e3ade5b60a5db696503e6b24c0781ad1cb30d99084d658e35fce4cde6eee6ed2d046297d6094c8f53b7c1510c3c05977162204617a8b
SSDEEP 12288:t3imjCfmRp0E5DRevVs25u1yW4mKhwR9PpLMtBSI5KZTOYRtKPms1G:Vim+mNev15u1yW4ZGrtMA5n8G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Browser Plugin.dll

Path \Nava Labs\Nava Shield\NavaBridge Libs\Browser Plugin.dll
Size 96KB
SHA256 bd474c5aafcaa12f20da5ecb29e17555b953eca46b4f56588a72672a36d4a8eb
MD5 912924f628e277be9cc28a5f2a990cb9
SHA1 13c0166469a271497043a2f13e9a6a610dc2b336
SHA512 b33b430254f9ec32ecd6224124db69af93de3cbfbaf422a0045641f7961834a67cba1b9fd97f4e0e903e27e3360301c5dba214a6b9156c4cdf8a25115b860c39
SSDEEP 1536:Meck2Ewvj398A7brhduw2MS9GzoONmkANW0coVitxglKo:Me+r9J77uw5jNuco8txgl
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaBridge.exe

Path \Nava Labs\Nava Shield\NavaBridge.exe
Size 2.5MB
SHA256 d39c80e19ddaf2c1d8e2e10136c475778358c389d0caba91eab599efbf0c58ae
MD5 beb9a1306c8001258b9df8c7a9c816ff
SHA1 63ac7fe58e9eedecdc35f2e12d3c263717b18d19
SHA512 0d4b9ec262993a19260386432acf9fc61819f2cf54e636abb392ac59427d02d4285b0a3c14b773ac709dbfffcb145588a83e9deb154ef52f33c709190bfb7e79
SSDEEP 49152:2Qex84rvg4fNdqaekoMS0BRAlfTcewuMva0NchhBAcThWoau9/v8y8SlQnsjI2wy:L4a0NIXCrkQN17g
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaDebugger.exe

Path \Nava Labs\Nava Shield\NavaDebugger.exe
Size 2.4MB
SHA256 1c23dfea6df21feb5d18b2914f961385608d63fd709209b57cbd701896ad9bb2
MD5 25873e5d9d605d2e0937420b404b22b6
SHA1 618a56b176c2edf76c2bfb8295dcf1fb35ef2cc8
SHA512 9680c68d1ae95663bc4c137aa4e75514322607132cb7cbccd7ddbf0fcb44a77699f0764b811b7401185c73f7b495a6eed7eb26d70c8b3af072914f125b66e41a
SSDEEP 49152:2Qex84rvg4fNdqaekoMS0BRAlfTcewuMva0NchhBAcThWoau9/v8y8SlQnsjI2wb:L4a0NIXCrkQF1V
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaMod.dll

Path \Nava Labs\Nava Shield\NavaMod.dll
Size 5KB
SHA256 abd84867d63a5449101b7171b1cc3907c44d7d327ea97d45b22a1015cc3af4dc
MD5 3d7f80fb0534d24f95ee377c40b72fb3
SHA1 11b443ed953dae35d9c9905b5bbeb309049f3d36
SHA512 7fc741bbce281873134b9f4d68b74ae04daf943ea4c0c26e7e44579f2d51883c635972a405dd81cee63079a5ba9d09328a1e26e7878547590569806d219d83c7
SSDEEP 48:6hUJSMYvo/8cUaNF0WmF6B6Ha/7uncBANxG5132GyMnkvJXiUek4Y:vJSBgkcUi0WDzicdWenkvJSUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Appearance Pak.dll

Path \Nava Labs\Nava Shield\NavaShield Libs\Appearance Pak.dll
Size 136KB
SHA256 e5b3249fbeea8395fd56c20511bfcfdb2b2632d3c8d517b943466a4e47f97b5c
MD5 fcf3ac25f11ba7e8b31c4baf1910f7a6
SHA1 fb470541f0b6b8f3ce69dcaa239ca9a7d7e91d72
SHA512 47c467924d64af4a48a6e640778aca1dce379d16b06bf3f60a44025034c15ce1498ef307b63cb04e5c0cbb6c2ac58022acdb0d6efb1109c5ea31f842a320aa40
SSDEEP 1536:Dkldogbpe1N0C3BuZAYx4Uhqf33qaYS86CXpmDtzUEQ9sn3p:DFgde1NHUAYWpgXpotAEusn3p
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaShield.exe

Path \Nava Labs\Nava Shield\NavaShield.exe
Size 1.1MB
SHA256 e1e6024b36a6e2ec620dd6f9db061a5e11b870229b398a25ddcebb4dc75ca7fe
MD5 8bab9091f9d45d9d83fdebcaa4655e0e
SHA1 8c92be10d23ec9f0210cd25253a831ecd43f679f
SHA512 e970345034b3aa600851410a4f8348c359f606fa4b225d619bef0b24ae9cd7b133a013425dd1a2f884d60a2514ab5a6c85f1887fb32483fbda7d53ba5e018ee1
SSDEEP 24576:HNsj8ESr2/ezS37xKNVLNpP0BrvTk4fNdqu5GpmZoMS0ySCAwaAlfTcewuMv5A0u:2Qex84rvg4fNdqaekoMS0BRAlfTcewu5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-143-0x00000000002C0000-0x00000000002DA000-memory.dmp

Download

memory/436-140-0x0000000000290000-0x00000000002A2000-memory.dmp

Download

memory/436-135-0x00000000025A0000-0x000000000272B000-memory.dmp

Download

memory/1560-149-0x0000000002460000-0x00000000025E7000-memory.dmp

Download

memory/2012-108-0x0000000002540000-0x000000000285B000-memory.dmp

Download

memory/2012-112-0x00000000006E0000-0x00000000006F2000-memory.dmp

Download

memory/2012-151-0x0000000069F80000-0x0000000069F88000-memory.dmp

Download

memory/2012-115-0x0000000000710000-0x000000000072A000-memory.dmp

Download

memory/2212-11-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2212-59-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2212-124-0x0000000000400000-0x000000000047A000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads