Resubmissions

02/03/2024, 22:38

240302-2kwptaae37 10

02/03/2024, 22:34

240302-2g86qsad96 10

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/03/2024, 22:34

General

  • Target

    Fake AV/Antivirus2010.exe

  • Size

    775KB

  • MD5

    f49bcb5336b1e1212ae82cbb98f8dfe4

  • SHA1

    fc87518aee297f9c18e40f4604ea048aec0342c4

  • SHA256

    1501affdcf557a9dcb73ae34d43365d5301532a48328564160fdc1f3acb01e2e

  • SHA512

    51a4b1a5ede81e4dbeb9a335fe3a370e6ae452a46d4f4ce8753b37d6e399b00e0de3b066921febf1b5b20f5e3356e0d93da5df366acd2002b792ecb7eb32a7e4

  • SSDEEP

    12288:msCyG0JUuqby8mkxhZZIQUopL1UnDs1WxWM1W0pdNkFGNjB7tDWYK:j/kxX/ZLwo1WgMPACBv

Malware Config

Signatures

  • Modifies security service 2 TTPs 3 IoCs
  • Windows security bypass 2 TTPs 4 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks registry for disk virtualization 3 TTPs 1 IoCs

    Detecting virtualization disks is order done to detect sandboxing environments.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 30 IoCs
  • Suspicious use of SetThreadContext 23 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 42 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies data under HKEY_USERS 30 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: MapViewOfSection 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    1⤵
      PID:272
    • C:\Users\Admin\AppData\Local\Temp\Fake AV\Antivirus2010.exe
      "C:\Users\Admin\AppData\Local\Temp\Fake AV\Antivirus2010.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Deletes itself
        PID:1724
      • \??\globalroot\systemroot\system32\usеrinit.exe
        /install
        2⤵
        • Sets service image path in registry
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3012
        • C:\Windows\system32\svchost.exe
          "C:\Windows\system32\svchost.exe"
          3⤵
          • Modifies security service
          • Windows security bypass
          • Modifies system executable filetype association
          • Checks registry for disk virtualization
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • Suspicious use of SetThreadContext
          • Checks SCSI registry key(s)
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2520
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" https://secure.2010billing.com/purchase/get.php?i=antvir&advert=3&extern=4&lang=EN
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2668
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2792
    • C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      1⤵
        PID:636
      • C:\Windows\system32\wbem\wmiprvse.exe
        C:\Windows\system32\wbem\wmiprvse.exe -Embedding
        1⤵
          PID:1900
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:2736
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
            1⤵
              PID:848

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    344B

                    MD5

                    33b3d0956cf1e67f6d99e50ff9ca4b72

                    SHA1

                    fc4acb2a82d5a3d3df7834de145748276305e2ae

                    SHA256

                    b3443acda6dc4679b02eb78011a6abdc9b430be0af87ee16dceeb3caf29f9791

                    SHA512

                    f201a105f5d2d4b3ba8c7d905fc290709d93fd2c8b1076fc5b66e803b89d4aa1e2ae64daba022f2473fc089e47d391edf7bdbaa43a36aae27d43345a0df0a619

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    344B

                    MD5

                    e8c8ad26e9f11b8928694bb2d6c6d94a

                    SHA1

                    32bfe7b01b90260cf7ac4e527544db21a18e2d77

                    SHA256

                    59df0721e4d7a01968a277611b7c87b9f90de375ed49e292b4f4e52d5a8b1c9a

                    SHA512

                    491d6c4bf7eccbe90222d167e8b381c7932f77ec4f66bccf41dc9a229bd8b356cd43e3ff848e3e9b86fc74d13f58d12f9346686474240ad7af6bff98aae376ee

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    344B

                    MD5

                    960fd6e3c4cdc6b807d17f5183771629

                    SHA1

                    0b9411a227592040fc7fab84ba09c0bef1af1b47

                    SHA256

                    77faa62106444cd9b4ab805fa8090ee361d96fe76ac37cdd6f82da2c089e83e5

                    SHA512

                    952ac212ac701a0bb560a4fff46874ed073ba1212883dab76f4cd2a753ddededda9b13c0f12420dfd42f9e24dc4cb9fea7232342506ca18f35afaa5d16afa1a0

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    344B

                    MD5

                    562bd3326b44ef8ff5b8a8dafdbcd71d

                    SHA1

                    dc5d49d3aa18f7f4b2455e8c66521a88dff16865

                    SHA256

                    6b61aafb816689db87e5623d5f125db9784b40cb65c3b390f99ab39562dd7cec

                    SHA512

                    cd766785b3d0d0a7d63de54a030b70a281d35a7e05c6cc65e766ddfe132c33020281ad8f745327fe14886be55317fe1cbe70270865890cb49b562be2adb60fa4

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    344B

                    MD5

                    525a799223225fc1377353ffa8d8bcd1

                    SHA1

                    0c0d1dafc844b63d820672f8967586d00a6159e6

                    SHA256

                    d8ab6a245af1599728c4c753bc8031e478dfce26e5f0c6738503e994d2243867

                    SHA512

                    ac63dcf10dfb07f9b54d92859d492db79d90096bb50791a6b5a37f1f7b83550e74c535920dd3270e19222f63b9784ce8c8b6dc4fb496214d1b532e618b352372

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    344B

                    MD5

                    c841051abe33a26f148bc8761b145c39

                    SHA1

                    1dbce39d749d88715f6acab03a5a83a9e211e9f4

                    SHA256

                    6e4e6863335ddcf5978e01482cd0798f325c43c2fa9cf09e5b6e2415004857da

                    SHA512

                    bdb62c311205ead009484111babaa0426b05daf4e09bbe5e33784dce95d9a4fea55e3eef17b8e6cee2b1ec713e83de92bd9f3ced1882693c7085a3b298d64089

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    344B

                    MD5

                    5356c799e535e8b9604d68074c5450da

                    SHA1

                    d49b6455fccdd16782da8c6bd100843e2b422032

                    SHA256

                    63f7c6561009827c552948ed158caa23ad70e3c4047f59b3575272638c97723b

                    SHA512

                    8132ec1b5adc24431f59d824768b8459fd3d507d4c8580b7c7935f5fe795ebec7d6065c809a3a3ef265314c917965b0a910bc0a7ae529a7d8f3421b53e1626db

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    344B

                    MD5

                    194a573050f71559bcd63ec8393f4032

                    SHA1

                    f63c29991b040840046ad7ac3e59620c10382fb0

                    SHA256

                    4c203b1bd151eb4a9ba6b74877f304fa5b2ba7a8d0b86bad8fb32cf950a22b08

                    SHA512

                    aa547eac5c2355f3a21872e1878aedd7418cb885d6c0cc94cc9e229a7ff5e6ac88dcaf914bd6ec508789f45329de00e595d2b296f59df78deaac164e5c445f4f

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    344B

                    MD5

                    23a73bf5863c72733dd8cfe5708e6e27

                    SHA1

                    badff23e7692a5d227932d1923b76ea6614844f4

                    SHA256

                    41abd4255977c86e552cf7f66e100fe2c52c7694d5c69527090138f147d79fb0

                    SHA512

                    1c83768a68b6e09abccb639c1590273266f0af8d7db0cfcf5bd81c77673fd9ab62a02a58416d27fafb6a38e1fb5158722c696d0636a658608cc05a26d5a66013

                  • C:\Users\Admin\AppData\Local\Temp\CabB696.tmp

                    Filesize

                    65KB

                    MD5

                    ac05d27423a85adc1622c714f2cb6184

                    SHA1

                    b0fe2b1abddb97837ea0195be70ab2ff14d43198

                    SHA256

                    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                    SHA512

                    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                  • C:\Users\Admin\AppData\Local\Temp\CabB7B0.tmp

                    Filesize

                    67KB

                    MD5

                    753df6889fd7410a2e9fe333da83a429

                    SHA1

                    3c425f16e8267186061dd48ac1c77c122962456e

                    SHA256

                    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

                    SHA512

                    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

                  • C:\Users\Admin\AppData\Local\Temp\TarB7D5.tmp

                    Filesize

                    175KB

                    MD5

                    dd73cead4b93366cf3465c8cd32e2796

                    SHA1

                    74546226dfe9ceb8184651e920d1dbfb432b314e

                    SHA256

                    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

                    SHA512

                    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

                  • C:\Users\Admin\AppData\Local\Temp\{E9C1E0AC-C9B1-4c85-94DE-9C1518918D02}.tlb

                    Filesize

                    2KB

                    MD5

                    63881935b6ff930a39df13a27c18c3f5

                    SHA1

                    d5464ca24d61b2efb562b1b4f4e0bef69c94cf04

                    SHA256

                    50d712b007a3339855619a4ad283661c07e13ec0a74465ea3d121439005cd1e5

                    SHA512

                    011d0307d088ac7a691ff504f8c3e99a06097fc27e10d40d62721cf6c6d0500120d040a7d32fd10aa50aeef1ef12be67501fff122bed129a354fb57c213a0ed9

                  • C:\Windows\System32\exefile.exe

                    Filesize

                    115KB

                    MD5

                    72178bb0f9674f0ce0b6b188d1219266

                    SHA1

                    ae3c43c7846c0ef977fa90991e1c366e34ab671c

                    SHA256

                    09cd3c864182b703a1384a15e60424c0ee8c82c3fd19f197c391a0e3ec5bd16e

                    SHA512

                    d9004c1b8402375c92690525f06ae83198bb929bb18dfc46fda9036a4054ed9c38637438b13ecc2566f98f2a8ac297ec7f0151b63a59c4f7bbc2ab8f7b6d779e

                  • C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx

                    Filesize

                    68KB

                    MD5

                    aef9e26239afcb4b33a86a2fa1d7c6cd

                    SHA1

                    9d7d776bff2ad58b4d779abdb6e9e95762240db8

                    SHA256

                    2d17533cf49cc30e382b259be3cfd2ed2a65d7d8919705fcde6eda818cb7caf0

                    SHA512

                    52ab2b4a2eff04921b0c482e98c6d490bb9f112efbdf254b87f5740d93754225643b5feac4ab98a25517aac7502f3bb7a95b14be91f110cc0bf251bda6170ea5

                  • \Windows\System32\usеrinit.exe

                    Filesize

                    139KB

                    MD5

                    4acd14244d2cd76d06939163127cfb10

                    SHA1

                    75f3e3c764f7d20c9950f5410f753f3210bcc2e7

                    SHA256

                    29b5b65a1cdf119ac7c6c9df76c6843b25a81bd00aa5a5e995ec675e34bf1acb

                    SHA512

                    001504da15c1825102479ba379b0be7ec15e779626d450d9d763552d7e1ac71f5bb86110f9361363bd401aabc53cdfd2d554480aec8bef85ed8c7b03cebf4031

                  • \systemroot\system32\msiavjyv.dll

                    Filesize

                    718KB

                    MD5

                    7943d251821ca441924f0d64946e8a3d

                    SHA1

                    cace099a490410260802ee143f7c7e3543f2f4cf

                    SHA256

                    be8dbcb59c3181ec518a6934931efc725a128310956fd076f0f0bd537b96a9eb

                    SHA512

                    0d4c9f021e07e2a27f3e7f46be591f01ec4c04fce98d9c177697ea4518d0c8d80105d73a29deff925cf28fce89a4fe40e790ef0086748dc169b1a8190e6d40f9

                  • memory/272-42-0x0000000000060000-0x0000000000077000-memory.dmp

                    Filesize

                    92KB

                  • memory/272-33-0x0000000000F50000-0x0000000000F56000-memory.dmp

                    Filesize

                    24KB

                  • memory/272-41-0x0000000000F50000-0x0000000000F56000-memory.dmp

                    Filesize

                    24KB

                  • memory/272-37-0x0000000000F50000-0x0000000000F56000-memory.dmp

                    Filesize

                    24KB

                  • memory/272-32-0x0000000000F30000-0x0000000000F33000-memory.dmp

                    Filesize

                    12KB

                  • memory/272-123-0x0000000000060000-0x0000000000077000-memory.dmp

                    Filesize

                    92KB

                  • memory/2124-1-0x0000000000400000-0x00000000004C4400-memory.dmp

                    Filesize

                    785KB

                  • memory/2124-9-0x0000000000400000-0x00000000004C4400-memory.dmp

                    Filesize

                    785KB

                  • memory/2124-2-0x0000000000630000-0x0000000000830000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2520-25-0x00000000000A0000-0x00000000000BA000-memory.dmp

                    Filesize

                    104KB

                  • memory/2520-280-0x00000000000A0000-0x00000000000BA000-memory.dmp

                    Filesize

                    104KB

                  • memory/2520-63-0x00000000000A0000-0x00000000000BA000-memory.dmp

                    Filesize

                    104KB

                  • memory/2520-55-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmp

                    Filesize

                    64KB

                  • memory/2520-30-0x00000000000A0000-0x00000000000BA000-memory.dmp

                    Filesize

                    104KB

                  • memory/2520-15-0x0000000000060000-0x0000000000077000-memory.dmp

                    Filesize

                    92KB

                  • memory/2520-20-0x00000000000A0000-0x00000000000BA000-memory.dmp

                    Filesize

                    104KB

                  • memory/2520-14-0x00000000000A0000-0x00000000000BA000-memory.dmp

                    Filesize

                    104KB