Resubmissions

02/03/2024, 22:38

240302-2kwptaae37 10

02/03/2024, 22:34

240302-2g86qsad96 10

Analysis

  • max time kernel
    148s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/03/2024, 22:34

General

  • Target

    Fake AV/PCDefender.exe

  • Size

    878KB

  • MD5

    e4d4a59494265949993e26dee7b077d1

  • SHA1

    83e3d0c7e544117d6054e7d55932a7d2dbaf1163

  • SHA256

    5ae57d8750822c203f5bf5e241c7132377b250df36a215dff2f396c8440b82dd

  • SHA512

    efd176555415e0771a22a6ca6f15a82aec14ca090d2599959612db9d8e07065e38a7b82e2bf7be67cbe1494733344879782f5516bb502e0177e7b540c96fa718

  • SSDEEP

    24576:bUWqistOB98g0Z1hPLX2jOmsQl3eW0a92Vdcvd7wR:bUUZ98g0FPLIRl3sa92Hcvd8R

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fake AV\PCDefender.exe
    "C:\Users\Admin\AppData\Local\Temp\Fake AV\PCDefender.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PCDefenderSilentSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1636
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D03C52A3A4BAC024271885A7D74981C4 M Global\MSI0000
      2⤵
      • Modifies WinLogon for persistence
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1660
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ /s /f
        3⤵
        • Modifies registry class
        PID:344
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ /s /f
        3⤵
        • Modifies registry class
        PID:1500
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ /s /f
        3⤵
        • Modifies registry class
        PID:820
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\SysWOW64\reg.exe" DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 /f
        3⤵
        • Modifies registry class
        PID:3032
      • C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe
        "C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe
          "C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe" Antispyware.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1148
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2520
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005BC" "00000000000004A0"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2896
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding
    1⤵
    • Drops desktop.ini file(s)
    • Modifies data under HKEY_USERS
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\System32\ie4uinit.exe
      "C:\Windows\System32\ie4uinit.exe" -ShowQLIcon
      2⤵
        PID:1700
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2144
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:537612 /prefetch:2
        2⤵
          PID:2560
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275482 /prefetch:2
          2⤵
            PID:2128

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Config.Msi\f76c19e.rbs

                Filesize

                9KB

                MD5

                c156397be71b0387833fa5ee82450c83

                SHA1

                f64696065ed78ecb6527c5c2bc14531b24283358

                SHA256

                24b9d981a3d19e77963e826656db1ef21f0d15caa89d2a5575c3c6a56d43162f

                SHA512

                ada3559e0c9a18acfd92c97af42dd037a4b2138afde8f12f5d719365ccfbeb8d4e0facd2f6268f5540fa05982d64d0c59626547e15b0ea4afc1f27ee5def122f

              • C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe

                Filesize

                1.4MB

                MD5

                af4761437567f84ffbec44c978ac2634

                SHA1

                488e27e01b629f3c2cd274a3c6572cdb040fc137

                SHA256

                41922380e3a419fea5a794a16e7abe3364c08da6c66fca0ce8f37c20e21ede68

                SHA512

                82694af3458a01040b9753f133e446c32fef105d4d36dfe8a5fa944080f4b6736dc8e4fbe2abb3db6f79ff24f8e1b9f07543c1193410cfa0a3faafd3e1ce096d

              • C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe

                Filesize

                88KB

                MD5

                c2514c216b4b6dac1a4d740126177f29

                SHA1

                c25d7b051339c9d0b1ee109abfb12724a24f130d

                SHA256

                8212f98e9caedd00bab3c3d561055507cd617cc2b2151c956968caeccde66e11

                SHA512

                dfe6dab9e14b539e50eea2b8314f3937f650eded149d1264763ee4d0d045bf1959569cb31e9e7d5bf602e49c68401cde02e2e552ef3d0baca2e4d48c53d78692

              • C:\Users\Admin\AppData\Local\Temp\Cab95CA.tmp

                Filesize

                67KB

                MD5

                753df6889fd7410a2e9fe333da83a429

                SHA1

                3c425f16e8267186061dd48ac1c77c122962456e

                SHA256

                b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

                SHA512

                9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PCDefenderSilentSetup.msi

                Filesize

                870KB

                MD5

                7f728acab22868ca02cc1ba0a14f5d64

                SHA1

                9e3e82b152447b8bcd27583fbdab7aa91ca4739d

                SHA256

                586f9a9af50b2a3321e77d2b4583741cc4842967af9429cc371534f7179caec4

                SHA512

                9bc8bb97e6d4f18ec484fcd792466cb5df0bf0447cbaa19a41258ef80e599e8a2b2c83c700f32f30bef578b03614af1b554844d051435dc9f510ccbd56686800

              • C:\Users\Admin\AppData\Local\Temp\Tar96E8.tmp

                Filesize

                175KB

                MD5

                dd73cead4b93366cf3465c8cd32e2796

                SHA1

                74546226dfe9ceb8184651e920d1dbfb432b314e

                SHA256

                a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

                SHA512

                ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

                Filesize

                2KB

                MD5

                fc9ac26379524208bd455b861448bbeb

                SHA1

                54430990d0189a6b039e1daae7b374b55c88466a

                SHA256

                06afcdd746b7d79c8929ae2f1dd7b5ce521bd7becd1fdfe221c9474627239c5f

                SHA512

                3c78c5bd1ce833307144707b5c10839fd90ce66450c1e1e4dd6b60ac0a701b3db3b3ea2d3eb1c8db2424f2527e003e768cf59b4c720294ada2338c12ba262097

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

                Filesize

                1KB

                MD5

                e9117b246600d04457dc58825bdc8b8c

                SHA1

                70ca6ff576281391cf7a0e86d2a6a0ef9205d919

                SHA256

                b2a94ad1cd5e92532171096eeeeda1a01a2408ebf0d636cba969338a8ee67edf

                SHA512

                ba29bb9c0b691e0d09208426a1cb17a74e8c9dca9cfd9dca1bed15fb3dd1cf476a28efee0237db1d23ef4ddbf0e30c74597524c003a568e509ba2c2eee0ad507

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

                Filesize

                1KB

                MD5

                e3aa453a55638bcecc11958b116dc597

                SHA1

                224fa7cbc8bd7364894bf00532eb0f4ca6468e3f

                SHA256

                41f0a1b15dd35c2d25442b17bf16602cdaddbea176765b01e8633b20c7edd544

                SHA512

                443e0543e35b120062cd2cee9d9a96caa042c3c90870a537ae10ae39c6527d78d32824b5b5a1e84db394ce3d7e16d3880a705e74b461f108af5315413ea89970

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

                Filesize

                1KB

                MD5

                a266bb7dcc38a562631361bbf61dd11b

                SHA1

                3b1efd3a66ea28b16697394703a72ca340a05bd5

                SHA256

                df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                SHA512

                0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

                Filesize

                488B

                MD5

                681abe65c2221b4836728a7675abcbc4

                SHA1

                be6e7dd30b388dd128497623bbf7371868a4623d

                SHA256

                8869fdd49509413447a06499efdc58e1275fc968fa58a04a1af642673d549a3e

                SHA512

                56dabd6426ddd43ff8889db2298d25c5d015332338c499cb0e06dc4a31fe305cf59e86405e2a37f06c66a6cac309615c0f9aabd0ccb6f1063a1b2b225670ad65

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

                Filesize

                488B

                MD5

                db09bd2b07eaf44f25aebcf9e35fffc7

                SHA1

                ee5620e85bcc2709fd42f8b0881da980d04d19b5

                SHA256

                19210beb9db1cae789065cffbd767bbf5c932b031d15a51bca1e4fd602009020

                SHA512

                2e790f721bb7d607ab20b7733d8ac2a3bdd992ef8c449a60239fb19d30f3478087d83f31f02c001f9e21e1be6afc9ceafc59f27f9fabbcd533f8e1e43ae444c0

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

                Filesize

                408B

                MD5

                477111e39ebd454644e9c32e5b1f6f83

                SHA1

                3cc96bc51579e43cbaeeed1c3d1b10522ab64e62

                SHA256

                1ccfe9d47acaf0038f8dc13d214d23dccbbe48e0b8c5461c903443fb1e644402

                SHA512

                88f188f54704d021f02db1056876c04c9ceed337f8b595ad87700c971d4b124ae0c70d773a7ad84e8dad3968952e44cbe58c8e7387c4ad5a808fd7a85d3cccac

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

                Filesize

                408B

                MD5

                a359c2feb92e48101aecfbc2acd9d9f1

                SHA1

                cc138b30159b47d5e5c05ac35c9834ffb9472cbd

                SHA256

                ba5d5e0bfb584469b6a710ad8a6dbff91f88aa53f4a74049cfad16f3e1d365d8

                SHA512

                d36ab594e1ff1967b7b6b7d750b2225eec8633c4debe07d085cbc232ecca0fd57b6e45db297b67415a2db61657178e0d0831fe1edcb533afb636ff4716d40b02

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                Filesize

                344B

                MD5

                ece29a6d223a9b0606015e0edaca2274

                SHA1

                7cb5496f3fddf20006215bf4d3db56c86a9f9f3d

                SHA256

                993e4ed452681c71c09a020f6dc286d31874775fb9adbc98728bc20827e6cf0e

                SHA512

                2964fb5ba228e5bb1c96cb90a477cfde43e85dacccc284d1394f2e19a4ad44c779d9ab48fc973abdccbbf0ecb22af26937776081e543dbaa4e65870a74b2aa42

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                Filesize

                344B

                MD5

                178c69ff569642a29d7e3e0d769ed1b6

                SHA1

                a132d6d0aa2d8b571ca6ae4d6edcc28ea13a8fa7

                SHA256

                f5e4ffe7bb46407aaee8789b6428dbbf0311957f63a23500b21bc6217f018d68

                SHA512

                6fc609ce963cf59889aca27ccbb592293b3b2d76cb1b1120e47598c1ff3974ece69fc402eb11a795bb7205faa2091a3518869f0c931b068d60bceb26653a0301

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                Filesize

                344B

                MD5

                3ce7c53aeb9eab187048331c272f93f8

                SHA1

                0117ce4f2fca2c639b9dd8660ced380e1378075d

                SHA256

                7b2270e1167fc804237a32fad034394a785b1a406fcc13e1643f072a5de28dc7

                SHA512

                cb8bf524e32387eff7b1a6f4c7c828a3aa0aa7d3eaa006b6cbc0ec1381b23e972d122b490196448ea4c088150bd48fa5187bea70db5c15ebc41a0e36b8582abd

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                Filesize

                344B

                MD5

                9ea0503fd3c3bef899992de41094a480

                SHA1

                3e5b1ac4f18d0cbefd9f1a2a631e6592c6cb248d

                SHA256

                b128cc5ab1bd55d27d9a6675cd7e61fa59f65e4181946104775a4bb2295c4f21

                SHA512

                c95b794bffef19b55d475aee50bba3bf41bb7ff5ee2b45b28a0578911cb01bfd8a6a1db9ff35006b823409fcdcd3f94d5b6e8ca454803e04c2803134d4536bc0

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                Filesize

                344B

                MD5

                d481bfbddb70443c28cb2a9f0fa61e7e

                SHA1

                8846dc9a93edceafaf079bf70dcd8cf5f00abb42

                SHA256

                135ede8e1351c764b4a381687f8203ea86432a1ba072e81297c80675edc4c1cd

                SHA512

                754ebc8df2dc7ce253678070f7b14da4903ac79c0ba67b58c1603adaeb0ab90e49466a4f1883f9bc3c4b984c9d7d861fdd6a73f0e57ec979abe97e0d16e6de4a

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                Filesize

                344B

                MD5

                11d92e1a68d26a59956082b62c2eafaf

                SHA1

                04cd9cb01e414161e5bb0d21899c99dc6291d7ac

                SHA256

                18fa8a791d338e48d2eb17759be9dc042a312909f3a6ac90e43afb931d47a87d

                SHA512

                3a97943d2143159453faab900c6083cc9c563cb8e251c3a72a0a3091a2ae9429c5a2f547c972e89f7b2595b80e5fbfb028e3d5e73c54e188a9e15a874572d70b

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

                Filesize

                482B

                MD5

                5efd3ae592c00b1af85f29d01ea68ede

                SHA1

                6026df67033828a93f8aca97185740ec268c39c5

                SHA256

                ab0a0626af2d84239698869118d3302d8184c421094c1ebbf38fa9475ee9bb47

                SHA512

                7a39a47da47627478a0365d8751d824e990b470cceed7c2e46f44de70751191e85744e38331673fd3c0c3bf86f68b958b252c84ba0099c6079d66fb88f34287c

              • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

                Filesize

                242B

                MD5

                f214c493fcdf1d0d7846f0e333dfd429

                SHA1

                6328cd1f245c473a710622f271dbc23958e8b36f

                SHA256

                b115366d00d960c96f2c54ce06f7b8af704cb2566182cdf75e29cf9576661dc5

                SHA512

                59200140399a99311b8eb5f4948a7569a568eb14449e05d2d4ddf1004de96ed52f8d970dcd6854ddfdbe08827f61467cfc2905549dfe90381b25b5395be5c38e

              • \Program Files (x86)\Def Group\PC Defender\hook.dll

                Filesize

                41KB

                MD5

                dc973050688bfd27a2d47e0ac2e21abb

                SHA1

                3ff84e8c292051aa7e57439aa44b7beac68b2d71

                SHA256

                e69c437e565390cbc0209e7934136cc68a7caa07cf7341c870dac35ca549b225

                SHA512

                4123df1cb903bff54897e1edd8c8c877e3fff9b81de9919569b3096fac8d80d06f73f005ef1c63269f4b50d7ee1965deb13d473b32f365c8324880ab995a600c

              • memory/1660-26-0x0000000000280000-0x0000000000282000-memory.dmp

                Filesize

                8KB

              • memory/2824-167-0x0000000002530000-0x0000000002532000-memory.dmp

                Filesize

                8KB