Overview
overview
10Static
static
7Fake AV/An...09.exe
windows7-x64
7Fake AV/An...09.exe
windows10-2004-x64
7Fake AV/Ana.exe
windows7-x64
8Fake AV/Ana.exe
windows10-2004-x64
7Fake AV/Antivirus.exe
windows7-x64
7Fake AV/Antivirus.exe
windows10-2004-x64
7Fake AV/An...10.exe
windows7-x64
10Fake AV/An...10.exe
windows10-2004-x64
7Fake AV/An...um.exe
windows7-x64
10Fake AV/An...um.exe
windows10-2004-x64
10Fake AV/An...17.exe
windows7-x64
7Fake AV/An...17.exe
windows10-2004-x64
7Fake AV/CleanThis.exe
windows7-x64
Fake AV/CleanThis.exe
windows10-2004-x64
Fake AV/Fa...er.exe
windows7-x64
7Fake AV/Fa...er.exe
windows10-2004-x64
76AdwCleaner.exe
windows7-x64
66AdwCleaner.exe
windows10-2004-x64
6Fake AV/Fi...ll.exe
windows7-x64
7Fake AV/Fi...ll.exe
windows10-2004-x64
7Fake AV/Ha...us.exe
windows7-x64
1Fake AV/Ha...us.exe
windows10-2004-x64
1Fake AV/In...rd.exe
windows7-x64
10Fake AV/In...rd.exe
windows10-2004-x64
9Fake AV/LPS2019.exe
windows7-x64
7Fake AV/LPS2019.exe
windows10-2004-x64
7Fake AV/Mo...eg.exe
windows7-x64
7Fake AV/Mo...eg.exe
windows10-2004-x64
3Fake AV/Na...ld.exe
windows7-x64
3Fake AV/Na...ld.exe
windows10-2004-x64
3Fake AV/PC...er.exe
windows7-x64
Fake AV/PC...er.exe
windows10-2004-x64
10Analysis
- max time kernel
942s - max time network
950s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
02/03/2024, 22:38
Behavioral task
behavioral1
Sample
Fake AV/AnViPC2009.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Fake AV/AnViPC2009.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
1800 seconds
Behavioral task
behavioral3
Sample
Fake AV/Ana.exe
Resource
win7-20240215-en
windows7-x64
20 signatures
1800 seconds
Behavioral task
behavioral4
Sample
Fake AV/Ana.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
1800 seconds
Behavioral task
behavioral5
Sample
Fake AV/Antivirus.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
1800 seconds
Behavioral task
behavioral6
Sample
Fake AV/Antivirus.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
1800 seconds
Behavioral task
behavioral7
Sample
Fake AV/Antivirus2010.exe
Resource
win7-20240221-en
windows7-x64
32 signatures
1800 seconds
Behavioral task
behavioral8
Sample
Fake AV/Antivirus2010.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
1800 seconds
Behavioral task
behavioral9
Sample
Fake AV/AntivirusPlatinum.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
1800 seconds
Behavioral task
behavioral10
Sample
Fake AV/AntivirusPlatinum.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
1800 seconds
Behavioral task
behavioral11
Sample
Fake AV/AntivirusPro2017.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
1800 seconds
Behavioral task
behavioral12
Sample
Fake AV/AntivirusPro2017.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
1800 seconds
Behavioral task
behavioral13
Sample
Fake AV/CleanThis.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
1800 seconds
Behavioral task
behavioral14
Sample
Fake AV/CleanThis.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
1800 seconds
Behavioral task
behavioral15
Sample
Fake AV/FakeAdwCleaner.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
1800 seconds
Behavioral task
behavioral16
Sample
Fake AV/FakeAdwCleaner.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
1800 seconds
Behavioral task
behavioral17
Sample
6AdwCleaner.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
1800 seconds
Behavioral task
behavioral18
Sample
6AdwCleaner.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
1800 seconds
Behavioral task
behavioral19
Sample
Fake AV/FileFixPro/FFProInstall.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
1800 seconds
Behavioral task
behavioral20
Sample
Fake AV/FileFixPro/FFProInstall.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
1800 seconds
Behavioral task
behavioral21
Sample
Fake AV/HappyAntivirus.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
1800 seconds
Behavioral task
behavioral22
Sample
Fake AV/HappyAntivirus.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
1800 seconds
Behavioral task
behavioral23
Sample
Fake AV/InternetSecurityGuard.exe
Resource
win7-20240221-en
windows7-x64
26 signatures
1800 seconds
Behavioral task
behavioral24
Sample
Fake AV/InternetSecurityGuard.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
22 signatures
1800 seconds
Behavioral task
behavioral25
Sample
Fake AV/LPS2019.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
1800 seconds
Behavioral task
behavioral26
Sample
Fake AV/LPS2019.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
1800 seconds
Behavioral task
behavioral27
Sample
Fake AV/Movie.mpeg.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
1800 seconds
Behavioral task
behavioral28
Sample
Fake AV/Movie.mpeg.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
1800 seconds
Behavioral task
behavioral29
Sample
Fake AV/NavaShield.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
1800 seconds
Behavioral task
behavioral30
Sample
Fake AV/NavaShield.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
1800 seconds
Behavioral task
behavioral31
Sample
Fake AV/PCDefender.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
1800 seconds
Behavioral task
behavioral32
Sample
Fake AV/PCDefender.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
1800 seconds
Errors
Reason
Machine shutdown
General
- Target Fake AV/PCDefender.exe
- Size 878KB
- Sample240302-2kwptaae37
- SHA256 5ae57d8750822c203f5bf5e241c7132377b250df36a215dff2f396c8440b82dd
- MD5 e4d4a59494265949993e26dee7b077d1
- SHA1 83e3d0c7e544117d6054e7d55932a7d2dbaf1163
- SHA512 efd176555415e0771a22a6ca6f15a82aec14ca090d2599959612db9d8e07065e38a7b82e2bf7be67cbe1494733344879782f5516bb502e0177e7b540c96fa718
- SSDEEP 24576:bUWqistOB98g0Z1hPLX2jOmsQl3eW0a92Vdcvd7wR:bUUZ98g0FPLIRl3sa92Hcvd8R
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,\"C:\\Program Files (x86)\\Def Group\\PC Defender\\Antispyware.exe\"" MsiExec.exe - Executes dropped EXE 2 IoCs
pid Process 2088 Antispyware.exe 1184 proccheck.exe - Loads dropped DLL 3 IoCs
pid Process 1508 MsiExec.exe 2088 Antispyware.exe 2088 Antispyware.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe msiexec.exe File created C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe msiexec.exe File created C:\Program Files (x86)\Def Group\PC Defender\hook.dll msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f76dd06.msi msiexec.exe File created C:\Windows\Installer\f76dd09.ipi msiexec.exe File created C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_966CD4ED37489844400D0C.exe msiexec.exe File created C:\Windows\Installer\f76dd06.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDFF3.tmp msiexec.exe File created C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_3F16219B047CF8432B7ADA.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_3F16219B047CF8432B7ADA.exe msiexec.exe File created C:\Windows\Installer\f76dd0b.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_966CD4ED37489844400D0C.exe msiexec.exe File opened for modification C:\Windows\Installer\f76dd09.ipi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\System32\RMActivate_ssp_isv.exe = "Trojan.Win32.Llac.bia" Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\System32\es-ES\wmpshell.dll.mui = "Trojan-Downloader.Win32.Genome.adut" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\System32\certcli.dll = "Trojan-Downloader.Win32.Banload.aozq" Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\System32\fr-FR\WsmSvc.dll.mui = "not-a-virus:CrackTool.Win32.Heater.bpe" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\scanSchedulerDayOfWeek = "0" Antispyware.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\updateSchedulerDayOfWeek = "0" Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\System32\de-DE\VaultCmd.exe.mui = "Trojan.Win32.Scar.bddh" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Def Group Antispyware.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Users\Admin\AppData\Local\Temp\Fake AV\Antivirus.exe = "Backdoor.Win32.WinUOJ.bdz" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\inf\prnky006.PNF = "Backdoor.Win32.ProRat.gek" Antispyware.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\scanSchedulerHour = "0" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\updateSchedulerMinute = "0" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\System32\de-DE\sendmail.dll.mui = "Trojan-Dropper.Win32.Agent.bkpz" Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\System32\qcap.dll = "Trojan-Dropper.Win32.Agent.bkpr" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\updateSchedulerHour = "0" Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\SysWOW64\sppc.dll = "not-a-virus:FraudTool.Win32.InternetAntivirusPro.aq" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\System32\hr-HR\msimsg.dll.mui = "Trojan-Downloader.Win32.Agent.czfl" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\System32\es-ES\l2nacp.dll.mui = "Trojan.Win32.VB.aade" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\System32\mfcm140u.dll = "Trojan-Downloader.Win32.Agent.czfl" Antispyware.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\System32\fr-FR\choice.exe.mui = "Backdoor.Win32.Hupigon.jpec" Antispyware.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\updateSchedulerSecond = "0" Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware\Found\C:\Windows\System32\en-US\ssText3d.scr.mui = "Trojan.Win32.Scar.bdcj" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Def Group\Antispyware Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main Antispyware.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Antispyware.exe - Modifies registry class 62 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\Net reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\PackageName = "PCDefenderSilentSetup.msi" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Media\1 = ";" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Net reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\DeploymentFlags = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Assignment = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Language = "1033" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\AdvertiseFlags = "388" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\InstanceType = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\PackageName = "PCDefenderSilentSetup.msi" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Version = "16777216" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\ProductName = "PC Defender" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\PackageCode = "18627594958587344B2B3984171915B1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\AdvertiseFlags = "388" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Version = "16777216" reg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Clients = 3a0000000000 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\PackageCode = "18627594958587344B2B3984171915B1" reg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Media\1 = ";" reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\InstanceType = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Net reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\InstanceType = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Clients = 3a0000000000 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\AuthorizedLUAApp = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C73BCE36FA1AA0E45AB2649A3FA0D390\E8CBA2CF517323A48B5B5539084F2528 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\AuthorizedLUAApp = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Language = "1033" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Media reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E8CBA2CF517323A48B5B5539084F2528 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C73BCE36FA1AA0E45AB2649A3FA0D390 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Media reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\Media reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\PackageCode = "18627594958587344B2B3984171915B1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\PackageName = "PCDefenderSilentSetup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\ProductName = "PC Defender" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Assignment = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\DeploymentFlags = "3" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\DeploymentFlags = "3" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E8CBA2CF517323A48B5B5539084F2528\DefaultFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\ProductName = "PC Defender" msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2968 msiexec.exe 2968 msiexec.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe 1184 proccheck.exe 1184 proccheck.exe 2088 Antispyware.exe 2088 Antispyware.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2312 msiexec.exe Token: SeIncreaseQuotaPrivilege 2312 msiexec.exe Token: SeRestorePrivilege 2968 msiexec.exe Token: SeTakeOwnershipPrivilege 2968 msiexec.exe Token: SeSecurityPrivilege 2968 msiexec.exe Token: SeCreateTokenPrivilege 2312 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2312 msiexec.exe Token: SeLockMemoryPrivilege 2312 msiexec.exe Token: SeIncreaseQuotaPrivilege 2312 msiexec.exe Token: SeMachineAccountPrivilege 2312 msiexec.exe Token: SeTcbPrivilege 2312 msiexec.exe Token: SeSecurityPrivilege 2312 msiexec.exe Token: SeTakeOwnershipPrivilege 2312 msiexec.exe Token: SeLoadDriverPrivilege 2312 msiexec.exe Token: SeSystemProfilePrivilege 2312 msiexec.exe Token: SeSystemtimePrivilege 2312 msiexec.exe Token: SeProfSingleProcessPrivilege 2312 msiexec.exe Token: SeIncBasePriorityPrivilege 2312 msiexec.exe Token: SeCreatePagefilePrivilege 2312 msiexec.exe Token: SeCreatePermanentPrivilege 2312 msiexec.exe Token: SeBackupPrivilege 2312 msiexec.exe Token: SeRestorePrivilege 2312 msiexec.exe Token: SeShutdownPrivilege 2312 msiexec.exe Token: SeDebugPrivilege 2312 msiexec.exe Token: SeAuditPrivilege 2312 msiexec.exe Token: SeSystemEnvironmentPrivilege 2312 msiexec.exe Token: SeChangeNotifyPrivilege 2312 msiexec.exe Token: SeRemoteShutdownPrivilege 2312 msiexec.exe Token: SeUndockPrivilege 2312 msiexec.exe Token: SeSyncAgentPrivilege 2312 msiexec.exe Token: SeEnableDelegationPrivilege 2312 msiexec.exe Token: SeManageVolumePrivilege 2312 msiexec.exe Token: SeImpersonatePrivilege 2312 msiexec.exe Token: SeCreateGlobalPrivilege 2312 msiexec.exe Token: SeBackupPrivilege 2808 vssvc.exe Token: SeRestorePrivilege 2808 vssvc.exe Token: SeAuditPrivilege 2808 vssvc.exe Token: SeBackupPrivilege 2968 msiexec.exe Token: SeRestorePrivilege 2968 msiexec.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeLoadDriverPrivilege 2892 DrvInst.exe Token: SeLoadDriverPrivilege 2892 DrvInst.exe Token: SeLoadDriverPrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2968 msiexec.exe Token: SeTakeOwnershipPrivilege 2968 msiexec.exe Token: SeRestorePrivilege 2968 msiexec.exe Token: SeTakeOwnershipPrivilege 2968 msiexec.exe Token: SeRestorePrivilege 2968 msiexec.exe Token: SeTakeOwnershipPrivilege 2968 msiexec.exe Token: SeRestorePrivilege 2968 msiexec.exe Token: SeTakeOwnershipPrivilege 2968 msiexec.exe Token: SeRestorePrivilege 2968 msiexec.exe Token: SeTakeOwnershipPrivilege 2968 msiexec.exe Token: SeRestorePrivilege 2968 msiexec.exe Token: SeTakeOwnershipPrivilege 2968 msiexec.exe Token: SeRestorePrivilege 2968 msiexec.exe Token: SeTakeOwnershipPrivilege 2968 msiexec.exe Token: SeRestorePrivilege 2968 msiexec.exe - Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 2312 msiexec.exe 2312 msiexec.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe - Suspicious use of SendNotifyMessage 30 IoCs
pid Process 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe - Suspicious use of SetWindowsHookEx 21 IoCs
pid Process 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe 2088 Antispyware.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2312 2020 PCDefender.exe 28 PID 2020 wrote to memory of 2312 2020 PCDefender.exe 28 PID 2020 wrote to memory of 2312 2020 PCDefender.exe 28 PID 2020 wrote to memory of 2312 2020 PCDefender.exe 28 PID 2020 wrote to memory of 2312 2020 PCDefender.exe 28 PID 2020 wrote to memory of 2312 2020 PCDefender.exe 28 PID 2020 wrote to memory of 2312 2020 PCDefender.exe 28 PID 2968 wrote to memory of 1508 2968 msiexec.exe 36 PID 2968 wrote to memory of 1508 2968 msiexec.exe 36 PID 2968 wrote to memory of 1508 2968 msiexec.exe 36 PID 2968 wrote to memory of 1508 2968 msiexec.exe 36 PID 2968 wrote to memory of 1508 2968 msiexec.exe 36 PID 2968 wrote to memory of 1508 2968 msiexec.exe 36 PID 2968 wrote to memory of 1508 2968 msiexec.exe 36 PID 1508 wrote to memory of 1572 1508 MsiExec.exe 38 PID 1508 wrote to memory of 1572 1508 MsiExec.exe 38 PID 1508 wrote to memory of 1572 1508 MsiExec.exe 38 PID 1508 wrote to memory of 1572 1508 MsiExec.exe 38 PID 1508 wrote to memory of 1444 1508 MsiExec.exe 40 PID 1508 wrote to memory of 1444 1508 MsiExec.exe 40 PID 1508 wrote to memory of 1444 1508 MsiExec.exe 40 PID 1508 wrote to memory of 1444 1508 MsiExec.exe 40 PID 1508 wrote to memory of 2280 1508 MsiExec.exe 42 PID 1508 wrote to memory of 2280 1508 MsiExec.exe 42 PID 1508 wrote to memory of 2280 1508 MsiExec.exe 42 PID 1508 wrote to memory of 2280 1508 MsiExec.exe 42 PID 1508 wrote to memory of 2820 1508 MsiExec.exe 43 PID 1508 wrote to memory of 2820 1508 MsiExec.exe 43 PID 1508 wrote to memory of 2820 1508 MsiExec.exe 43 PID 1508 wrote to memory of 2820 1508 MsiExec.exe 43 PID 1508 wrote to memory of 2088 1508 MsiExec.exe 46 PID 1508 wrote to memory of 2088 1508 MsiExec.exe 46 PID 1508 wrote to memory of 2088 1508 MsiExec.exe 46 PID 1508 wrote to memory of 2088 1508 MsiExec.exe 46 PID 2088 wrote to memory of 1184 2088 Antispyware.exe 47 PID 2088 wrote to memory of 1184 2088 Antispyware.exe 47 PID 2088 wrote to memory of 1184 2088 Antispyware.exe 47 PID 2088 wrote to memory of 1184 2088 Antispyware.exe 47 PID 2088 wrote to memory of 364 2088 Antispyware.exe 49 PID 2088 wrote to memory of 364 2088 Antispyware.exe 49 PID 2088 wrote to memory of 364 2088 Antispyware.exe 49 PID 2088 wrote to memory of 364 2088 Antispyware.exe 49 PID 364 wrote to memory of 836 364 cmd.exe 51 PID 364 wrote to memory of 836 364 cmd.exe 51 PID 364 wrote to memory of 836 364 cmd.exe 51 PID 364 wrote to memory of 836 364 cmd.exe 51 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fake AV\PCDefender.exe"C:\Users\Admin\AppData\Local\Temp\Fake AV\PCDefender.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PCDefenderSilentSetup.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2312
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2EFC51A00FF5DF89ADBAE9431B9F1281 M Global\MSI00002⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ /s /f3⤵
- Modifies registry class
PID:1572
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ /s /f3⤵
- Modifies registry class
PID:1444
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ /s /f3⤵PID:2280
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 /f3⤵
- Modifies registry class
PID:2820
-
-
C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe"C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe"C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe" Antispyware.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -r -t 104⤵
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\shutdown.exeshutdown -r -t 105⤵PID:836
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005C8" "00000000000005C4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2524
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\f76dd0a.rbs
- Size 9KB
- SHA256 126c710e52d36c6845f721aba2b5ec15b31c3d185f50a1795578d2d77c59b327
- MD5 6898db0c62460b040aa55c3d2b11eb64
- SHA1 de98de92107ae91205261efcbe66b025fdc30631
- SHA512 7f81051d11d2daf9c96923e574da8f912eb2cd6f933c26497935eae40c38eb351d25cd88b8f40142c37785e0ed00045a91fd962a988f6c26bb6af60bbb840c74
- SSDEEP 192:sKrR2ERkEkp/ORididin13evBObBO4rUl8POMppE:sKr9lkRORididinKB8B2f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe
- Size 132KB
- SHA256 576083d5ce4054ef2e7d8d6bd436e7be9ee367fb1e48a9ad52d430b68eedc343
- MD5 822e6f7f1dad653d830cf8ffecb176f1
- SHA1 48d3496bb354a2f749042cff9a14f2e2fee79bc3
- SHA512 85a5f74716b364fc97e682b3d233600b4d8c8a4212f56fff2ed34110b3adeaf5ab33318d516081416a3e45e5335f13302642405cc62f82d55d53273c097a794f
- SSDEEP 3072:pykJLWFe/MRKqKqKPq8E1ilq0nyScCn35Qr9H46qxXG/vEaI2:RwKqKqKPqR1ilq0nyScCJQr9Y6qxX0I2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Def Group\PC Defender\hook.dll
- Size 41KB
- SHA256 e69c437e565390cbc0209e7934136cc68a7caa07cf7341c870dac35ca549b225
- MD5 dc973050688bfd27a2d47e0ac2e21abb
- SHA1 3ff84e8c292051aa7e57439aa44b7beac68b2d71
- SHA512 4123df1cb903bff54897e1edd8c8c877e3fff9b81de9919569b3096fac8d80d06f73f005ef1c63269f4b50d7ee1965deb13d473b32f365c8324880ab995a600c
- SSDEEP 768:O5/CvILWqNJC1lOYx+UP5LjR7WW01RoMRYKayF:gKQPM1lOIP5LjsrRna
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\PCDefenderSilentSetup.msi
- Size 870KB
- SHA256 586f9a9af50b2a3321e77d2b4583741cc4842967af9429cc371534f7179caec4
- MD5 7f728acab22868ca02cc1ba0a14f5d64
- SHA1 9e3e82b152447b8bcd27583fbdab7aa91ca4739d
- SHA512 9bc8bb97e6d4f18ec484fcd792466cb5df0bf0447cbaa19a41258ef80e599e8a2b2c83c700f32f30bef578b03614af1b554844d051435dc9f510ccbd56686800
- SSDEEP 24576:EGaBoXF1IG15cQWLiCMlTCuyAy/JR2rL627G1xVX:EGaBQFSS5c4ZlVyA6AP7G1nX
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Def Group\PC Defender\Antispyware.exe
- Size 1.4MB
- SHA256 41922380e3a419fea5a794a16e7abe3364c08da6c66fca0ce8f37c20e21ede68
- MD5 af4761437567f84ffbec44c978ac2634
- SHA1 488e27e01b629f3c2cd274a3c6572cdb040fc137
- SHA512 82694af3458a01040b9753f133e446c32fef105d4d36dfe8a5fa944080f4b6736dc8e4fbe2abb3db6f79ff24f8e1b9f07543c1193410cfa0a3faafd3e1ce096d
- SSDEEP 24576:aKqKqKPqR1+qiyScCJQr9Y6qxEHTfid0t7z2+5wloqKwIKK1wVfO7qfbPLQLmE4i:DQOyHTQ0l2xTflfr1izlqSU3Qg501+1
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Def Group\PC Defender\proccheck.exe
- Size 88KB
- SHA256 8212f98e9caedd00bab3c3d561055507cd617cc2b2151c956968caeccde66e11
- MD5 c2514c216b4b6dac1a4d740126177f29
- SHA1 c25d7b051339c9d0b1ee109abfb12724a24f130d
- SHA512 dfe6dab9e14b539e50eea2b8314f3937f650eded149d1264763ee4d0d045bf1959569cb31e9e7d5bf602e49c68401cde02e2e552ef3d0baca2e4d48c53d78692
- SSDEEP 1536:RqynhiCiBRL5F/IhBmKkgqoAtCmUNcZKO0u9Nqh8BpJwMtBZETLcwgJ50AKBZ3+:RqohirBRLT/Ih0KkgqoA8v8Cu98KSCBb
- MD5 SHA1 SHA512 SSDEEP