Resubmissions

02/03/2024, 22:38

240302-2kwptaae37 10

02/03/2024, 22:34

240302-2g86qsad96 10

Analysis

  • max time kernel
    152s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2024, 22:34

General

  • Target

    Fake AV/PCDefender.exe

  • Size

    878KB

  • MD5

    e4d4a59494265949993e26dee7b077d1

  • SHA1

    83e3d0c7e544117d6054e7d55932a7d2dbaf1163

  • SHA256

    5ae57d8750822c203f5bf5e241c7132377b250df36a215dff2f396c8440b82dd

  • SHA512

    efd176555415e0771a22a6ca6f15a82aec14ca090d2599959612db9d8e07065e38a7b82e2bf7be67cbe1494733344879782f5516bb502e0177e7b540c96fa718

  • SSDEEP

    24576:bUWqistOB98g0Z1hPLX2jOmsQl3eW0a92Vdcvd7wR:bUUZ98g0FPLIRl3sa92Hcvd8R

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fake AV\PCDefender.exe
    "C:\Users\Admin\AppData\Local\Temp\Fake AV\PCDefender.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4372
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PCDefenderSilentSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2500
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1468
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding EDB8E2C4D105E8B14E8F9980575AC7AF E Global\MSI0000
        2⤵
        • Modifies WinLogon for persistence
        • Modifies data under HKEY_USERS
        PID:1220
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4540
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4212
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaa8489758,0x7ffaa8489768,0x7ffaa8489778
        2⤵
          PID:3724
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1916,i,17749516175133300583,9419090901374229005,131072 /prefetch:2
          2⤵
            PID:920
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1916,i,17749516175133300583,9419090901374229005,131072 /prefetch:8
            2⤵
              PID:3804
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 --field-trial-handle=1916,i,17749516175133300583,9419090901374229005,131072 /prefetch:8
              2⤵
                PID:5024
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1916,i,17749516175133300583,9419090901374229005,131072 /prefetch:1
                2⤵
                  PID:3120
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1916,i,17749516175133300583,9419090901374229005,131072 /prefetch:1
                  2⤵
                    PID:4036
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4528 --field-trial-handle=1916,i,17749516175133300583,9419090901374229005,131072 /prefetch:1
                    2⤵
                      PID:5284
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 --field-trial-handle=1916,i,17749516175133300583,9419090901374229005,131072 /prefetch:8
                      2⤵
                        PID:5460
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5108 --field-trial-handle=1916,i,17749516175133300583,9419090901374229005,131072 /prefetch:8
                        2⤵
                          PID:5504
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1916,i,17749516175133300583,9419090901374229005,131072 /prefetch:8
                          2⤵
                            PID:5636
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:5128

                          Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Config.Msi\e5811e0.rbs

                                  Filesize

                                  10KB

                                  MD5

                                  c94dabdd1e33f0a09652fa6bc7bfc184

                                  SHA1

                                  b48183e017fc43e4abe2d999fd6ca9ccecccc66e

                                  SHA256

                                  4b96540bbad8a7acca851013b6f35a5cb7ec3120c6ca5b9f3fd1e2fff5a68d5d

                                  SHA512

                                  b6a3f2d4ab933255a19054974398825cfb217d6b160e976730333e854b58c415e8f2f5e525e65fcac433adf93e2e848f1557d82d6b5eeb771a70bbbe5c6e7db4

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  371B

                                  MD5

                                  b1339764e026ac9bdb7e673a0d2fb17a

                                  SHA1

                                  17bb45545722f681e29bb0542e03e8b9f4f41465

                                  SHA256

                                  5ae84ac103d09ce26a77380e25b5c53ae6b0acf7825a4310aba4ec16a0a61698

                                  SHA512

                                  3090f3e46d0d8e4cef31071592244e2b6a735d909c06f082dbe46e5643658198c8a1abcfcc1c359b0f834e8a1d32c646dd5f5da638fe9ee0112f0f877d930e4b

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  3fb10993e95dad2c3ec354cea001108b

                                  SHA1

                                  da42344fa918b69bbf488736bbb0dbc840098e4d

                                  SHA256

                                  7e204a42441eb6c3f9f494acae2bcbbfc7bc474b799951471bc3b909c8d279f4

                                  SHA512

                                  481c052abe31b61f1c48d8db91777ff6d55d4c749c543b8705aed0f35d92ac9a78d8f5c2bf5339812dfba25578c06b16eaa53db2b2757154bb87514b8fca4f65

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                  Filesize

                                  15KB

                                  MD5

                                  4a17848095bea25aecfa2687952c96c6

                                  SHA1

                                  fd49f9400efcac4ed473c742f6851563e0ec1cde

                                  SHA256

                                  ab3f4158cf1e2f64477e4e3b142ef5e6e056d07d4d336645127f70e1263d154c

                                  SHA512

                                  143291ace88842560a5f0b24402f9301fcca2c4f6893762d5927520edad1d1618d87736f94ffacb91a346d20823274785cdbf46854f659b37a7862bdf0dc222a

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  254KB

                                  MD5

                                  4b21c844fe63940cc4dc14c66f92416f

                                  SHA1

                                  c08525bbfec0f1b168ea9d4f61b476e3d824308d

                                  SHA256

                                  2b3264da95ba92c2cdafb5badcfc02f94db79953a008e08a8b659a8f9a65ea51

                                  SHA512

                                  96adebf75b6af07e16881284374d0057bc6ebf0d605e866cc249493bd5b0f5a88c5a8b887d40e0bceb32ebb8a0a0e283b33ee7c5740ff59ef2f6043fcdcbfb51

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PCDefenderSilentSetup.msi

                                  Filesize

                                  870KB

                                  MD5

                                  7f728acab22868ca02cc1ba0a14f5d64

                                  SHA1

                                  9e3e82b152447b8bcd27583fbdab7aa91ca4739d

                                  SHA256

                                  586f9a9af50b2a3321e77d2b4583741cc4842967af9429cc371534f7179caec4

                                  SHA512

                                  9bc8bb97e6d4f18ec484fcd792466cb5df0bf0447cbaa19a41258ef80e599e8a2b2c83c700f32f30bef578b03614af1b554844d051435dc9f510ccbd56686800

                                • C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_3F16219B047CF8432B7ADA.exe

                                  Filesize

                                  21KB

                                  MD5

                                  b84df77564555c63c899fce0fcec7edb

                                  SHA1

                                  e63e7560b3c583616102cad58b06433b1a9903b0

                                  SHA256

                                  912ebab4ab2ea830b961df778dd854e555c89e05e25b7c02b3737429115405f9

                                  SHA512

                                  857717981c44a6a5fbb1bd34308e981c448746e0ea2d5bea94516fea20d0186e00a3547ad0b948c10fd9493e3ca00c0899927b0fa51c240697faacbbecca033a

                                • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                                  Filesize

                                  22.9MB

                                  MD5

                                  6ef1fc6b1984c9bcd4ddf002e09be3d7

                                  SHA1

                                  05d0364bfc7d50d4d76ddf517156ecf1b1517125

                                  SHA256

                                  5c5d5a681e552e8b003e8ec2711bd7ffec5c923bd529d7c8a16f7f440dd4a113

                                  SHA512

                                  2ebfa5218479ea34f23c7fde15f86bf8447ebc798490d1b0029931c0f55c717119f5a8c47a6141a7c090f897cb45720f7910afb0e8e4b48f1513284d0739760f

                                • \??\Volume{ef7552f8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f2fc0da7-0319-4d25-a2d3-2d4826c35753}_OnDiskSnapshotProp

                                  Filesize

                                  6KB

                                  MD5

                                  4938c71bd8c2422235e1fe2027f16d65

                                  SHA1

                                  ee894facb01f9cd1d0764bc8bf4ac16c4ccd525e

                                  SHA256

                                  0c36e793a2adf0d69a57705bfdf96c3ed1c31d71fcce2f558fb5e2284b1e416c

                                  SHA512

                                  850db522ee1af1885815fec4eb67dc9bf7815314ab36eae4a6f6bee0535e1b75fd6924b0e574ea2b34906d78020c612d48091f06231a5253094ac0365009ff45