aee69ef9040e902b7a6639d7594df47e0e73625143a671583db8b85be525a3e5

Resubmissions

02/03/2024, 22:38

240302-2kwptaae3710

02/03/2024, 22:34

240302-2g86qsad9610

Analysis

max time kernel
1796s
max time network
1172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fake AV/AnViPC2009.exe
Size 1.2MB
Sample240302-2kwptaae37
SHA256 06effc4c15d371b5c40a84995a7bae75324b690af9fbe2e8980f8c0e0901bf45
MD5 910dd666c83efd3496f21f9f211cdc1f
SHA1 77cd736ee1697beda0ac65da24455ec566ba7440
SHA512 467d3b4d45a41b90c8e29c8c3d46ddfbdee9875606cd1c1b7652c2c7e26d60fedac54b24b75def125d450d8e811c75974260ba48a79496d2bdaf17d674eddb47
SSDEEP 24576:Lutr5OUF7zfbMEsJiZp8uSOBpik+Qijrcq0y0JL4SprofsCghjmxQ:LuXfbMvGei9yjrcq0y0JL4ggghjv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	AnViPC2009.exe

Executes dropped EXE 1 IoCs

pid	Process
1492	avpc2009.exe

Loads dropped DLL 3 IoCs

pid	Process
1492	avpc2009.exe
1492	avpc2009.exe
1492	avpc2009.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\antiviruspc2009\libltdl3.dll	AnViPC2009.exe
File opened for modification	C:\Program Files (x86)\antiviruspc2009\libltdl3.dll	AnViPC2009.exe
File created	C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll	AnViPC2009.exe
File opened for modification	C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll	AnViPC2009.exe
File created	C:\Program Files (x86)\antiviruspc2009\bzip2.dll	AnViPC2009.exe
File opened for modification	C:\Program Files (x86)\antiviruspc2009\bzip2.dll	AnViPC2009.exe
File opened for modification	C:\Program Files (x86)\antiviruspc2009	AnViPC2009.exe
File created	C:\Program Files (x86)\antiviruspc2009\__tmp_rar_sfx_access_check_240608078	AnViPC2009.exe
File created	C:\Program Files (x86)\antiviruspc2009\avpc2009.exe	AnViPC2009.exe
File opened for modification	C:\Program Files (x86)\antiviruspc2009\avpc2009.exe	AnViPC2009.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	26	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	27	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	28	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1492	avpc2009.exe
1492	avpc2009.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1492	avpc2009.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1492	avpc2009.exe
1492	avpc2009.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 1492	348	AnViPC2009.exe	89
PID 348 wrote to memory of 1492	348	AnViPC2009.exe	89
PID 348 wrote to memory of 1492	348	AnViPC2009.exe	89

C:\Users\Admin\AppData\Local\Temp\Fake AV\AnViPC2009.exe
"C:\Users\Admin\AppData\Local\Temp\Fake AV\AnViPC2009.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:348
- C:\Program Files (x86)\antiviruspc2009\avpc2009.exe
  "C:\Program Files (x86)\antiviruspc2009\avpc2009.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avpc2009.exe

Path C:\Program Files (x86)\antiviruspc2009\avpc2009.exe
Size 9.0MB
SHA256 9c42eca99e96a7402716fd865b57ea601fb9a18477fe2ab890bdbcd3052f68f8
MD5 c18a7323332b3292a8e0f1c81df65698
SHA1 bcb8f34cbe0137e888d06acbcb6508417851a087
SHA512 4d48d11f3d0a740b9193e17782c77b01f52dd6e8324755aa81188295a0caed0718d330453bb02ca8bc942ee5588928e57a0d89d90d6b1c32690338c5eae8e1ad
SSDEEP 98304:akMZNqXXZh/M7Y13c9FAddv2z6/HsRsUrnlBvaFOUREPaRZMF6knx82R617:k17Y13c9AvWaFOUREPaRZMF6knx8Q617
MD5 SHA1 SHA512 SSDEEP

Submit Download

avpc2009.exe

Path C:\Program Files (x86)\antiviruspc2009\avpc2009.exe
Size 5.8MB
SHA256 7aa3aead8d7aeff5b10ca443fc682d1b6418ffaf27b61f4ccb811a7df830d7f2
MD5 b886cb93de0811beb07c886483d58e07
SHA1 9386f63500c551a1883974c5b5ff34abe94e2293
SHA512 c3f8ac0b1a74397dec0ba06df91a22eb8f841a761eba5f87ee582f179ac2208e8c7d9466c84657d6aa24c72559c0b31dbe34ad2dc89ff997ec477e9d403796ce
SSDEEP 98304:akMZNqXXZh/M7Y13c9FAddv2z6/HsRsUrnlBvaFOUR9:k17Y13c9AvWaFOUR9
MD5 SHA1 SHA512 SSDEEP

Submit Download

avpc2009.exe

Path C:\Program Files (x86)\antiviruspc2009\avpc2009.exe
Size 5.6MB
SHA256 a35fda5c2804ae29c313019c9e1defa2a5329bb8d2b2a9fa55078902f5b9a291
MD5 f3d394a5990455c681e56f83f104f9fc
SHA1 87ef361bed8b0570aa57a40eecf66c5b78499388
SHA512 53ecd4b3a26b7a981a2ece70495c86043806b77e7c8280fdee241a2ece95f30e02b65f2b748cbf93ad58a0c19b6e9d2044a59ce83bb04e0783ba477744a590db
SSDEEP 98304:akMZNqXXZh/M7Y13c9FAddv2z6/HsRsUrnlBvaFOURQ:k17Y13c9AvWaFOURQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bzip2.dll

Path C:\Program Files (x86)\antiviruspc2009\bzip2.dll
Size 67KB
SHA256 da25db24809479051d980be5e186926dd53233a76dfe357a455387646befca76
MD5 4143d4973e0f5a5180e114bdd868d4d2
SHA1 b47fd2cf9db0f37c04e4425085fb953cbce81478
SHA512 e21827712a4870461921e7996506ffe456dd2303b69de370aa0499dde2e4747a73d8c0e8bd7d91c5bbc414ed5ee06f36d172237489494b3dd311ccd95ba07ebc
SSDEEP 1536:S9FWW0igMY08p/41AdhEfWoh8eGf9NvvvvvvvvvvvvvvvvJQfBq:S9FxMJj3EWne290
MD5 SHA1 SHA512 SSDEEP

Submit Download

libltdl3.dll

Path C:\Program Files (x86)\antiviruspc2009\libltdl3.dll
Size 34KB
SHA256 f9c9d2b92efb80f6d11df52735b8bddd099847cc79ba56650793b21a0923b1cd
MD5 00a71b4afda8033235432b1c433fecc7
SHA1 d7b0c218aa8fec1c60ada26a09d9e0d9601985ca
SHA512 96635e66d9781ad4d2414271f6a0904cf880ed94fc19186ef4da5f88f24e14ef1591fdc90e27db15a6021847c592688d0034f20e2e50ca93bf8c6db27e8c510a
SSDEEP 768:IZw9E10THMXYyumdlZ3+aJdKE/z85TISX+RfnW:IC9E1yHMXNfdX3+TWz8WRu
MD5 SHA1 SHA512 SSDEEP

Submit Download

pthreadVC2.dll

Path C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll
Size 84KB
SHA256 8aecab563b3c629e8f9dcd525dc2d6b1903f6c600637e63b1efe05e3c64d757b
MD5 0ab7d0e87f3843f8104b3670f5a9af62
SHA1 10c09a12e318f0fbebf70c4c42ad6ee31d9df2e5
SHA512 e08e17167edf461c0fca1e8b649c0c395793e80f5400f5cbb7d7906d0c99e955fcf6be2300db8663d413c4b3ffb075112a6ce5bf259553c0fd3d76200ee0d375
SSDEEP 768:bspjN7masPcbmZOzyKGdsmkHtpwpSH3UMp4K0/06gZiH3YbcZ8ysAa23Zm:eOEEMzHtpc2l0/0JZiH3YbcZ8lh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1492-27-0x0000000068440000-0x0000000068457000-memory.dmp

Download

memory/1492-28-0x000000006FDC0000-0x000000006FDCE000-memory.dmp

Download

memory/1492-41-0x000000006FDC0000-0x000000006FDCE000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads