aee69ef9040e902b7a6639d7594df47e0e73625143a671583db8b85be525a3e5

Resubmissions

02/03/2024, 22:38

240302-2kwptaae3710

02/03/2024, 22:34

240302-2g86qsad9610

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fake AV/NavaShield.exe
Size 9.7MB
Sample240302-2g86qsad96
SHA256 83ecb875f87150a88f4c3d496eb3cb5388cd8bafdff4879884ececdbd1896e1d
MD5 1f13396fa59d38ebe76ccc587ccb11bb
SHA1 867adb3076c0d335b9bfa64594ef37a7e2c951ff
SHA512 82ca2c781bdaa6980f365d1eedb0af5ac5a80842f6edc28a23a5b9ea7b6feec5cd37d54bd08d9281c9ca534ed0047e1e234873b06c7d2b6fe23a7b88a4394fdc
SSDEEP 196608:CtbTP1ErBwMQjd1YTHdmpCP2PVgP/acIE/xQ0zyZejVk+YzbRdTZ:C1E1+dYx6OP9hdyZwV4zd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	NavaShield.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	NavaShield.exe

Executes dropped EXE 3 IoCs

pid	Process
4656	NavaShield.exe
2580	NavaBridge.exe
380	NavaDebugger.exe

Loads dropped DLL 12 IoCs

pid	Process
4656	NavaShield.exe
4656	NavaShield.exe
4656	NavaShield.exe
4656	NavaShield.exe
4656	NavaShield.exe
4656	NavaShield.exe
2580	NavaBridge.exe
2580	NavaBridge.exe
2580	NavaBridge.exe
2580	NavaBridge.exe
2580	NavaBridge.exe
380	NavaDebugger.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NavaShield = "c:\\Nava Labs\\Nava Shield\\navashield.exe"	NavaShield.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	NavaShield.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	NavaShield.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4656	NavaShield.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1832	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1832	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4656	NavaShield.exe
4656	NavaShield.exe
4656	NavaShield.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4656	NavaShield.exe
4656	NavaShield.exe
4656	NavaShield.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 4656	1264	NavaShield.exe	95
PID 1264 wrote to memory of 4656	1264	NavaShield.exe	95
PID 1264 wrote to memory of 4656	1264	NavaShield.exe	95
PID 4656 wrote to memory of 2580	4656	NavaShield.exe	97
PID 4656 wrote to memory of 2580	4656	NavaShield.exe	97
PID 4656 wrote to memory of 2580	4656	NavaShield.exe	97
PID 4656 wrote to memory of 380	4656	NavaShield.exe	98
PID 4656 wrote to memory of 380	4656	NavaShield.exe	98
PID 4656 wrote to memory of 380	4656	NavaShield.exe	98

C:\Users\Admin\AppData\Local\Temp\Fake AV\NavaShield.exe
"C:\Users\Admin\AppData\Local\Temp\Fake AV\NavaShield.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Nava Labs\Nava Shield\NavaShield.exe
  "C:\Nava Labs\Nava Shield\NavaShield.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Nava Labs\Nava Shield\NavaBridge.exe
    "C:\Nava Labs\Nava Shield\NavaBridge.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2580
- - C:\Nava Labs\Nava Shield\NavaDebugger.exe
    "C:\Nava Labs\Nava Shield\NavaDebugger.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:380

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x510
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Browser Plugin.dll

Path C:\Nava Labs\Nava Shield\NavaBridge Libs\Browser Plugin.dll
Size 96KB
SHA256 bd474c5aafcaa12f20da5ecb29e17555b953eca46b4f56588a72672a36d4a8eb
MD5 912924f628e277be9cc28a5f2a990cb9
SHA1 13c0166469a271497043a2f13e9a6a610dc2b336
SHA512 b33b430254f9ec32ecd6224124db69af93de3cbfbaf422a0045641f7961834a67cba1b9fd97f4e0e903e27e3360301c5dba214a6b9156c4cdf8a25115b860c39
SSDEEP 1536:Meck2Ewvj398A7brhduw2MS9GzoONmkANW0coVitxglKo:Me+r9J77uw5jNuco8txgl
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaBridge.exe

Path C:\Nava Labs\Nava Shield\NavaBridge.exe
Size 3.2MB
SHA256 0d12740248a3849bc5f92134502a95dc413fcd6be25fa6893b1c05f920ed2cb7
MD5 903a4e6e78dc62bc7b9e261ff3cce399
SHA1 a6a9ae0572ab0ed14cb62441f1f1ed0d3b52d926
SHA512 31b9fb9bdaa78c18276f1d1da93ce099b19437f1fb27f0e4b0f49b82881aff40bc7d610ba755283461a6fd9c20dc669b86ff453e6b52f4633a38177bb6b89daf
SSDEEP 49152:2Qex84rvg4fNdqaekoMS0BRAlfTcewuMva0NchhBAcThWoau9/v8y8SlQnsjI2wc:L4a0NIXCrkQN17C
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaBridge.exe

Path C:\Nava Labs\Nava Shield\NavaBridge.exe
Size 1.4MB
SHA256 3bf536a387ce91a81936b4f3bb1df34d19e80b22e98c08e7b87b757075ebac67
MD5 8c54a7f80cc21f50908023844bd88a77
SHA1 cf0f590a1c93356b77358d56311578b75b98cc57
SHA512 5e45edcb0c9c76e1c4b8ad52a2da899547416f69a3f931c04c439b2d447ce5d2fad40ea5a389645a225eb32086b65c91d37b778c6ace0764ff26d95f9f231e1f
SSDEEP 24576:HNsj8ESr2/ezS37xKNVLNpP0BrvTk4fNdqu5GpmZoMS0ySCAwaAlfTcewuMv5A0m:2Qex84rvg4fNdqaekoMS0BRAlfTcewuF
MD5 SHA1 SHA512 SSDEEP

Submit Download

MD5.dll

Path C:\Nava Labs\Nava Shield\NavaDebugger Libs\MD5.dll
Size 92KB
SHA256 8341ecc0938ca6d90b7e0f02af2d7e6b571c948a03a99d54af61c4557c78d656
MD5 831295342c47b770bf7cc591a6916fa7
SHA1 2c9063fbf3f3363526abdc241bf90618b82446d1
SHA512 01419defe963a987989cddb0e21cf651ec3eefeae97cf4b257d4caa8da26436a647e8e4d95cdad22bbb0657171f6d3d9c41dc6fb217ffc7d5172ebc9a409d36e
SSDEEP 768:RL2roNiodgYJVLc5x8hSq5seR7y0LZdg4GXRxkdx4lKvi7OPYntGDa3V7:RL3UoxJVLc5xPwRdLf6K67Oiti
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaDebugger.exe

Path C:\Nava Labs\Nava Shield\NavaDebugger.exe
Size 1024KB
SHA256 84040973247c112d18ccf5495311df65f2bbe6b98c464cb2562549d03e8ad0ec
MD5 bc379ff85e4b9b5886f7416d7e1014be
SHA1 f74a8db0c0c2b19ded9b22ed8ea2183388845d08
SHA512 95fb614a24be346c43acf572eed58a46defb4017f771453d83bfdb820f17f4ff1855d6f2c2b6822bf3f939f9bc7743adf81366e315aaf7e2816a6e5abccd668a
SSDEEP 24576:HNsj8ESr2/ezS37xKNVLNpP0BrvTk4fNdqu5GpmZoMS0ySCAwaAlfTcewuMv5A0n:2Qex84rvg4fNdqaekoMS0BRAlfTcewu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaDebugger.exe

Path C:\Nava Labs\Nava Shield\NavaDebugger.exe
Size 9.2MB
SHA256 660cc09f9d69a1ff879a811b765e1fa898081019d029d77cf833a9a915ae9873
MD5 404501846c15ee0774025ded425d4707
SHA1 87c4af4698aa2294b53fe4c6349ff552cfa38356
SHA512 4bbb20aea92140c1057e9131141a543c0d3bf46578f92a0b2fc8448b4b8fc106b98a5d44212f6c197d1ec77dbac32d7cb21935fcc72ef31b339c5b8e3080dec6
SSDEEP 196608:L4aINr4D6Dk886nmNPJk1vn0bwqGhgXaxsSZpsw8m6Ea7Q:8U+DZmNKBgwqqgXa6Hw8m6Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaMod.dll

Path C:\Nava Labs\Nava Shield\NavaMod.dll
Size 5KB
SHA256 abd84867d63a5449101b7171b1cc3907c44d7d327ea97d45b22a1015cc3af4dc
MD5 3d7f80fb0534d24f95ee377c40b72fb3
SHA1 11b443ed953dae35d9c9905b5bbeb309049f3d36
SHA512 7fc741bbce281873134b9f4d68b74ae04daf943ea4c0c26e7e44579f2d51883c635972a405dd81cee63079a5ba9d09328a1e26e7878547590569806d219d83c7
SSDEEP 48:6hUJSMYvo/8cUaNF0WmF6B6Ha/7uncBANxG5132GyMnkvJXiUek4Y:vJSBgkcUi0WDzicdWenkvJSUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Appearance Pak.dll

Path C:\Nava Labs\Nava Shield\NavaShield Libs\Appearance Pak.dll
Size 136KB
SHA256 e5b3249fbeea8395fd56c20511bfcfdb2b2632d3c8d517b943466a4e47f97b5c
MD5 fcf3ac25f11ba7e8b31c4baf1910f7a6
SHA1 fb470541f0b6b8f3ce69dcaa239ca9a7d7e91d72
SHA512 47c467924d64af4a48a6e640778aca1dce379d16b06bf3f60a44025034c15ce1498ef307b63cb04e5c0cbb6c2ac58022acdb0d6efb1109c5ea31f842a320aa40
SSDEEP 1536:Dkldogbpe1N0C3BuZAYx4Uhqf33qaYS86CXpmDtzUEQ9sn3p:DFgde1NHUAYWpgXpotAEusn3p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Internet Encodings.dll

Path C:\Nava Labs\Nava Shield\NavaShield Libs\Internet Encodings.dll
Size 72KB
SHA256 a50e56dfb68410a7927ecd50f55044756b54868e920e462671162d1961bfe744
MD5 de5eefa1b686e3d32e3ae265392492bd
SHA1 7b37b0ac1061366bf1a7f267392ebc0d606bb3db
SHA512 c71270a5275f91214444449be4923a70243a9e2cd06afcc6fd28ab9f2cd2d930219ce8ed9ec008750b2611b62ed26b65cb57a75c6035201cd9657263d157d508
SSDEEP 768:WUdOtOXf9NaR0WdK2B2aPqmsVTGiNkD4Pi6FV/GOZtuGwFV:pOIf9k1K2B2S4rq4fFV/ftupV
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaShield.exe

Path C:\Nava Labs\Nava Shield\NavaShield.exe
Size 3.6MB
SHA256 20201d9a8462d9b26908b6482044610c7e1551f0b8e981cae20c2510af0ed12b
MD5 310ee3a3e78d0b21e6e09225a80f6cc0
SHA1 b0e1cd52ef63f0ad14049fc4237875794c4f5ecc
SHA512 dc6112b43cad6fc13b8976c833231e38809880a966ae544803c0499257e78289b265c0b27d901e2593b554c366eb1cf3372033ab1ca3f492ab81fc52a062d8d8
SSDEEP 49152:2Qex84rvg4fNdqaekoMS0BRAlfTcewuMva0NchhBAcThWoau9/v8y8SlQnsjI2ws:L4a0NIXCrkQX1de
MD5 SHA1 SHA512 SSDEEP

Submit Download

NavaShield.exe

Path C:\Nava Labs\Nava Shield\NavaShield.exe
Size 4.2MB
SHA256 7d95aa92c14e385bc35087e143a3bff894c34974da1310c9c5cc9ec4ea17e82c
MD5 69f41559fca633978b2bd4032b5c0a49
SHA1 5fcf9c203b39a7e0ee2a9c92541149310cbe20fa
SHA512 e1945fe0db154b5ad6e1e707b89dfd3f1f1d3191d618c8be549e5a7d9ee13bcd1b7a69f8a1f916b9588b756f0e78f19c89df39d99c709e8325c08af55e580744
SSDEEP 49152:2Qex84rvg4fNdqaekoMS0BRAlfTcewuMva0NchhBAcThWoau9/v8y8SlQnsjI2wt:L4a0NIXCrkQX1dKCv
MD5 SHA1 SHA512 SSDEEP

Submit Download

bridge.dat

Path C:\Nava Labs\Nava Shield\bridge.dat
Size 176B
SHA256 45fa6eacea58e682c2ef2bb9e888cb6bf396c37b957fd144ca73c95699ad3c74
MD5 e66f1107f995d52bcd90421b3cdc0dde
SHA1 245acafa2f3dab3f2b7f183d34267dcd976199c0
SHA512 0500f9dec5cfdfb80bc5763943deb3111ccde4b35f19ac124df2e5abde2681154977f160a42e9ef50698b0ea0cc26fc09361a3917534038f141dd047f0287c1f
MD5 SHA1 SHA512

Submit Download

config.dat

Path C:\Nava Labs\Nava Shield\config.dat
Size 4KB
SHA256 da4728e17ae412494f6b548e21b136fbb830abc4a2bac5fd7c1522a2a729271c
MD5 b0f4924346d2daa81a9f7d241a987d6c
SHA1 190356e26e8054f338d1f4b6a4e582e02149f7fa
SHA512 8eddb6eaf687aa5cb4bbdf3f0914e401dd42c488f8d68243d705608197006ee09195d39f80b6ff5b878be4e18238297bf1a38e60d82b72e3f53c7a998a8e1e1e
SSDEEP 96:20WgagJCDwVnBH3unWWuvobNReZY5Qv/BlUkKAwJX79wkxa9c66FH:x/zGeBXuWWuvomeSw1mkwL6FH
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.dat

Path C:\Nava Labs\Nava Shield\config.dat
Size 4KB
SHA256 8adfe6ddd57f59595cb026b09726b3146fc59b8f28183146cdd46e499d0ad527
MD5 3cad4610cca4159318a0e77632d3ef08
SHA1 e0d3c55b5992744e5b7d938873c682601a461fc1
SHA512 37034028fc483d1b3bdeea24574c1113c0fca858f09e4bf4c3aa5ffce0a3016997dc559d4b8f4b5f66be415dba9539ce4d06e05ba6c83ac1609a71aba5039c01
SSDEEP 96:lnsW5LP6LbN/nTn2fK2zZvP844wack0vgaCwL95lUIOX2v9wVp:dEtTn2fRFEZhcdY3wLzi+m3
MD5 SHA1 SHA512 SSDEEP

Submit Download

navig.dat

Path C:\Nava Labs\Nava Shield\navig.dat
Size 255B
SHA256 9c4723ecb77e39e58eda9c60f532724aa3bf69de30047cc7b6522534cd423f00
MD5 0bf850cb9d0aa0f4c778cc515b79bd13
SHA1 c0cb8a58cba046d2c7539025a39c8a1af81c3914
SHA512 649c13f9f4fccc03ebd6cb2c3752434c69b5a8d7e9b94cac80cd98a7624bfd00648949b18cd720faf89fae050f6b523221db589a550c6ce4513e76ff0895da5b
MD5 SHA1 SHA512

Submit Download

0001.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp
Size 452KB
SHA256 b95cbd2158693bbd3cefedfdc40cf4acae63883fa17ec4e9f8a38fb7b4593c1b
MD5 4fe19c390d4cbaaa6faae51a9131923c
SHA1 a3c114ab35f37b0444939ae479ed33a3a5ee6f13
SHA512 a7ea9145e9dfeb36adc13bdb2ccc286ab946a219899cb25b384e3788a90b43ee40c88584c64cbb77de074b8ff92fb8db9bd2b68af47b0a11d779c96bc154f24d
SSDEEP 6144:t3exmMaCfV4Xha0UGAUcmaO5d1R42S5T1VtXISU25+bQQyWcu378kVmUBZ3G/IPq:t3imjCfmRp0E5DRevVs25u1yW4mKhwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/380-154-0x0000000002600000-0x0000000002787000-memory.dmp

Download

memory/1264-110-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1264-130-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1264-11-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2580-141-0x00000000025B0000-0x000000000273B000-memory.dmp

Download

memory/2580-151-0x0000000002960000-0x000000000297A000-memory.dmp

Download

memory/2580-147-0x0000000002940000-0x0000000002952000-memory.dmp

Download

memory/4656-135-0x0000000069F80000-0x0000000069F88000-memory.dmp

Download

memory/4656-117-0x00000000026A0000-0x00000000029BB000-memory.dmp

Download

memory/4656-116-0x0000000003E30000-0x0000000003E42000-memory.dmp

Download

memory/4656-121-0x0000000003E60000-0x0000000003E7A000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads