Analysis
-
max time kernel
33s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02/03/2024, 16:39
Static task
static1
General
-
Target
-
Size
878KB
-
MD5
e4d4a59494265949993e26dee7b077d1
-
SHA1
83e3d0c7e544117d6054e7d55932a7d2dbaf1163
-
SHA256
5ae57d8750822c203f5bf5e241c7132377b250df36a215dff2f396c8440b82dd
-
SHA512
efd176555415e0771a22a6ca6f15a82aec14ca090d2599959612db9d8e07065e38a7b82e2bf7be67cbe1494733344879782f5516bb502e0177e7b540c96fa718
-
SSDEEP
24576:bUWqistOB98g0Z1hPLX2jOmsQl3eW0a92Vdcvd7wR:bUUZ98g0FPLIRl3sa92Hcvd8R
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,\"C:\\Program Files (x86)\\Def Group\\PC Defender\\Antispyware.exe\"" MsiExec.exe -
Executes dropped EXE 5 IoCs
pid Process 556 Antispyware.exe 304 proccheck.exe 1948 Antispyware.exe 2112 proccheck.exe 1052 Antispyware.exe -
Loads dropped DLL 5 IoCs
pid Process 1992 MsiExec.exe 556 Antispyware.exe 556 Antispyware.exe 1948 Antispyware.exe 1052 Antispyware.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe msiexec.exe File created C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe msiexec.exe File created C:\Program Files (x86)\Def Group\PC Defender\hook.dll msiexec.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\f76405a.msi msiexec.exe File created C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_966CD4ED37489844400D0C.exe msiexec.exe File opened for modification C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_966CD4ED37489844400D0C.exe msiexec.exe File created C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_3F16219B047CF8432B7ADA.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI41B2.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76405a.msi msiexec.exe File created C:\Windows\Installer\f76405d.ipi msiexec.exe File created C:\Windows\Installer\f76405f.msi msiexec.exe File opened for modification C:\Windows\Installer\f76405d.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_3F16219B047CF8432B7ADA.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main Antispyware.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main Antispyware.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware\Found\C:\Windows\inf\mdmaiwa4.inf = "Backdoor.Win32.Bifrose.cbfm" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware\scanSchedulerMinute = "0" Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware\updateSchedulerNever = "1" Antispyware.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware\updateSchedulerMinute = "0" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware\scanSchedulerDayOfWeek = "0" Antispyware.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware Antispyware.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware\scanSchedulerDaily = "0" Antispyware.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware\scanSchedulerSecond = "0" Antispyware.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware\updateSchedulerSecond = "0" Antispyware.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Antispyware.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware\scanSchedulerHour = "0" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware\ Antispyware.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware\scanSchedulerNever = "1" Antispyware.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Def Group\Antispyware\updateSchedulerDayOfWeek = "0" Antispyware.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Antispyware.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\AdvertiseFlags = "388" reg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Clients = 3a0000000000 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Language = "1033" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Media reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\InstanceType = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E8CBA2CF517323A48B5B5539084F2528\DefaultFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\ProductName = "PC Defender" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\AuthorizedLUAApp = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\Net reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\InstanceType = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Version = "16777216" reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Net reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\AuthorizedLUAApp = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\AuthorizedLUAApp = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Net reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\InstanceType = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\PackageCode = "18627594958587344B2B3984171915B1" reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\PackageCode = "18627594958587344B2B3984171915B1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C73BCE36FA1AA0E45AB2649A3FA0D390\E8CBA2CF517323A48B5B5539084F2528 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\AdvertiseFlags = "388" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\PackageName = "PCDefenderSilentSetup.msi" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\PackageName = "PCDefenderSilentSetup.msi" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Media reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\AdvertiseFlags = "388" reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\Media reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\PackageCode = "18627594958587344B2B3984171915B1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Version = "16777216" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Language = "1033" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\DeploymentFlags = "3" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\ProductName = "PC Defender" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\AuthorizedLUAApp = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Assignment = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\Net reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\SourceList\PackageName = "PCDefenderSilentSetup.msi" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\SourceList\PackageName = "PCDefenderSilentSetup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\PackageCode = "18627594958587344B2B3984171915B1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\DeploymentFlags = "3" reg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Clients = 3a0000000000 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\DeploymentFlags = "3" reg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_\Clients = 3a0000000000 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2528 msiexec.exe 2528 msiexec.exe 556 Antispyware.exe 556 Antispyware.exe 304 proccheck.exe 304 proccheck.exe 556 Antispyware.exe 556 Antispyware.exe 304 proccheck.exe 304 proccheck.exe 556 Antispyware.exe 556 Antispyware.exe 304 proccheck.exe 304 proccheck.exe 556 Antispyware.exe 556 Antispyware.exe 304 proccheck.exe 304 proccheck.exe 556 Antispyware.exe 556 Antispyware.exe 304 proccheck.exe 304 proccheck.exe 556 Antispyware.exe 556 Antispyware.exe 304 proccheck.exe 304 proccheck.exe 556 Antispyware.exe 556 Antispyware.exe 304 proccheck.exe 304 proccheck.exe 556 Antispyware.exe 556 Antispyware.exe 304 proccheck.exe 304 proccheck.exe 556 Antispyware.exe 556 Antispyware.exe 304 proccheck.exe 304 proccheck.exe 556 Antispyware.exe 556 Antispyware.exe 304 proccheck.exe 304 proccheck.exe 1948 Antispyware.exe 1948 Antispyware.exe 2112 proccheck.exe 2112 proccheck.exe 556 Antispyware.exe 556 Antispyware.exe 304 proccheck.exe 304 proccheck.exe 1948 Antispyware.exe 1948 Antispyware.exe 2112 proccheck.exe 2112 proccheck.exe 556 Antispyware.exe 556 Antispyware.exe 304 proccheck.exe 304 proccheck.exe 1948 Antispyware.exe 1948 Antispyware.exe 2112 proccheck.exe 2112 proccheck.exe 556 Antispyware.exe 556 Antispyware.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1276 msiexec.exe Token: SeIncreaseQuotaPrivilege 1276 msiexec.exe Token: SeRestorePrivilege 2528 msiexec.exe Token: SeTakeOwnershipPrivilege 2528 msiexec.exe Token: SeSecurityPrivilege 2528 msiexec.exe Token: SeCreateTokenPrivilege 1276 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1276 msiexec.exe Token: SeLockMemoryPrivilege 1276 msiexec.exe Token: SeIncreaseQuotaPrivilege 1276 msiexec.exe Token: SeMachineAccountPrivilege 1276 msiexec.exe Token: SeTcbPrivilege 1276 msiexec.exe Token: SeSecurityPrivilege 1276 msiexec.exe Token: SeTakeOwnershipPrivilege 1276 msiexec.exe Token: SeLoadDriverPrivilege 1276 msiexec.exe Token: SeSystemProfilePrivilege 1276 msiexec.exe Token: SeSystemtimePrivilege 1276 msiexec.exe Token: SeProfSingleProcessPrivilege 1276 msiexec.exe Token: SeIncBasePriorityPrivilege 1276 msiexec.exe Token: SeCreatePagefilePrivilege 1276 msiexec.exe Token: SeCreatePermanentPrivilege 1276 msiexec.exe Token: SeBackupPrivilege 1276 msiexec.exe Token: SeRestorePrivilege 1276 msiexec.exe Token: SeShutdownPrivilege 1276 msiexec.exe Token: SeDebugPrivilege 1276 msiexec.exe Token: SeAuditPrivilege 1276 msiexec.exe Token: SeSystemEnvironmentPrivilege 1276 msiexec.exe Token: SeChangeNotifyPrivilege 1276 msiexec.exe Token: SeRemoteShutdownPrivilege 1276 msiexec.exe Token: SeUndockPrivilege 1276 msiexec.exe Token: SeSyncAgentPrivilege 1276 msiexec.exe Token: SeEnableDelegationPrivilege 1276 msiexec.exe Token: SeManageVolumePrivilege 1276 msiexec.exe Token: SeImpersonatePrivilege 1276 msiexec.exe Token: SeCreateGlobalPrivilege 1276 msiexec.exe Token: SeBackupPrivilege 2632 vssvc.exe Token: SeRestorePrivilege 2632 vssvc.exe Token: SeAuditPrivilege 2632 vssvc.exe Token: SeBackupPrivilege 2528 msiexec.exe Token: SeRestorePrivilege 2528 msiexec.exe Token: SeRestorePrivilege 2448 DrvInst.exe Token: SeRestorePrivilege 2448 DrvInst.exe Token: SeRestorePrivilege 2448 DrvInst.exe Token: SeRestorePrivilege 2448 DrvInst.exe Token: SeRestorePrivilege 2448 DrvInst.exe Token: SeRestorePrivilege 2448 DrvInst.exe Token: SeRestorePrivilege 2448 DrvInst.exe Token: SeLoadDriverPrivilege 2448 DrvInst.exe Token: SeLoadDriverPrivilege 2448 DrvInst.exe Token: SeLoadDriverPrivilege 2448 DrvInst.exe Token: SeRestorePrivilege 2528 msiexec.exe Token: SeTakeOwnershipPrivilege 2528 msiexec.exe Token: SeRestorePrivilege 2528 msiexec.exe Token: SeTakeOwnershipPrivilege 2528 msiexec.exe Token: SeRestorePrivilege 2528 msiexec.exe Token: SeTakeOwnershipPrivilege 2528 msiexec.exe Token: SeRestorePrivilege 2528 msiexec.exe Token: SeTakeOwnershipPrivilege 2528 msiexec.exe Token: SeRestorePrivilege 2528 msiexec.exe Token: SeTakeOwnershipPrivilege 2528 msiexec.exe Token: SeRestorePrivilege 2528 msiexec.exe Token: SeTakeOwnershipPrivilege 2528 msiexec.exe Token: SeRestorePrivilege 2528 msiexec.exe Token: SeTakeOwnershipPrivilege 2528 msiexec.exe Token: SeRestorePrivilege 2528 msiexec.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1276 msiexec.exe 1276 msiexec.exe 556 Antispyware.exe 1948 Antispyware.exe 1052 Antispyware.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 556 Antispyware.exe 1948 Antispyware.exe 1052 Antispyware.exe -
Suspicious use of SetWindowsHookEx 36 IoCs
pid Process 556 Antispyware.exe 556 Antispyware.exe 556 Antispyware.exe 556 Antispyware.exe 556 Antispyware.exe 556 Antispyware.exe 556 Antispyware.exe 556 Antispyware.exe 556 Antispyware.exe 556 Antispyware.exe 556 Antispyware.exe 556 Antispyware.exe 1948 Antispyware.exe 1948 Antispyware.exe 1948 Antispyware.exe 1948 Antispyware.exe 1948 Antispyware.exe 1948 Antispyware.exe 1948 Antispyware.exe 1948 Antispyware.exe 1948 Antispyware.exe 1948 Antispyware.exe 1948 Antispyware.exe 1948 Antispyware.exe 1052 Antispyware.exe 1052 Antispyware.exe 1052 Antispyware.exe 1052 Antispyware.exe 1052 Antispyware.exe 1052 Antispyware.exe 1052 Antispyware.exe 1052 Antispyware.exe 1052 Antispyware.exe 1052 Antispyware.exe 1052 Antispyware.exe 1052 Antispyware.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2260 wrote to memory of 1276 2260 [email protected] 28 PID 2260 wrote to memory of 1276 2260 [email protected] 28 PID 2260 wrote to memory of 1276 2260 [email protected] 28 PID 2260 wrote to memory of 1276 2260 [email protected] 28 PID 2260 wrote to memory of 1276 2260 [email protected] 28 PID 2260 wrote to memory of 1276 2260 [email protected] 28 PID 2260 wrote to memory of 1276 2260 [email protected] 28 PID 2528 wrote to memory of 1992 2528 msiexec.exe 34 PID 2528 wrote to memory of 1992 2528 msiexec.exe 34 PID 2528 wrote to memory of 1992 2528 msiexec.exe 34 PID 2528 wrote to memory of 1992 2528 msiexec.exe 34 PID 2528 wrote to memory of 1992 2528 msiexec.exe 34 PID 2528 wrote to memory of 1992 2528 msiexec.exe 34 PID 2528 wrote to memory of 1992 2528 msiexec.exe 34 PID 1992 wrote to memory of 540 1992 MsiExec.exe 36 PID 1992 wrote to memory of 540 1992 MsiExec.exe 36 PID 1992 wrote to memory of 540 1992 MsiExec.exe 36 PID 1992 wrote to memory of 540 1992 MsiExec.exe 36 PID 1992 wrote to memory of 784 1992 MsiExec.exe 38 PID 1992 wrote to memory of 784 1992 MsiExec.exe 38 PID 1992 wrote to memory of 784 1992 MsiExec.exe 38 PID 1992 wrote to memory of 784 1992 MsiExec.exe 38 PID 1992 wrote to memory of 1148 1992 MsiExec.exe 40 PID 1992 wrote to memory of 1148 1992 MsiExec.exe 40 PID 1992 wrote to memory of 1148 1992 MsiExec.exe 40 PID 1992 wrote to memory of 1148 1992 MsiExec.exe 40 PID 1992 wrote to memory of 2336 1992 MsiExec.exe 42 PID 1992 wrote to memory of 2336 1992 MsiExec.exe 42 PID 1992 wrote to memory of 2336 1992 MsiExec.exe 42 PID 1992 wrote to memory of 2336 1992 MsiExec.exe 42 PID 1992 wrote to memory of 556 1992 MsiExec.exe 44 PID 1992 wrote to memory of 556 1992 MsiExec.exe 44 PID 1992 wrote to memory of 556 1992 MsiExec.exe 44 PID 1992 wrote to memory of 556 1992 MsiExec.exe 44 PID 556 wrote to memory of 304 556 Antispyware.exe 45 PID 556 wrote to memory of 304 556 Antispyware.exe 45 PID 556 wrote to memory of 304 556 Antispyware.exe 45 PID 556 wrote to memory of 304 556 Antispyware.exe 45 PID 1948 wrote to memory of 2112 1948 Antispyware.exe 48 PID 1948 wrote to memory of 2112 1948 Antispyware.exe 48 PID 1948 wrote to memory of 2112 1948 Antispyware.exe 48 PID 1948 wrote to memory of 2112 1948 Antispyware.exe 48 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PCDefenderSilentSetup.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1276
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 71AA340524A4D9270EA015A138DC85D0 M Global\MSI00002⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ /s /f3⤵
- Modifies registry class
PID:540
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ /s /f3⤵
- Modifies registry class
PID:784
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528_ /s /f3⤵
- Modifies registry class
PID:1148
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528 /f3⤵
- Modifies registry class
PID:2336
-
-
C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe"C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe"C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe" Antispyware.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:304
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003D4" "000000000000039C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe"C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe"C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe" Antispyware.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2112
-
-
C:\Program Files\Windows Defender\MSASCui.exe"C:\Program Files\Windows Defender\MSASCui.exe"1⤵PID:2424
-
C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe"C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD59ebe73b0da14e32c19ed94445e34a9ee
SHA177e98228c192a24adeb14d9f02eb4790b67ed3ed
SHA25687e6e733a90474844a05a6c922e6196d1ecd0c8502faeb6ce6b5b873cb6daeac
SHA5125fe5eb18974f56ae66bf9a7a32aaa44d89fb8bbe32ace0ac0f78b12d282a31529fbc4aa5b709d648cd1b2737f38cf24a75513ed18e9093ae92127d6bfb40200e
-
Filesize
1.4MB
MD5af4761437567f84ffbec44c978ac2634
SHA1488e27e01b629f3c2cd274a3c6572cdb040fc137
SHA25641922380e3a419fea5a794a16e7abe3364c08da6c66fca0ce8f37c20e21ede68
SHA51282694af3458a01040b9753f133e446c32fef105d4d36dfe8a5fa944080f4b6736dc8e4fbe2abb3db6f79ff24f8e1b9f07543c1193410cfa0a3faafd3e1ce096d
-
Filesize
88KB
MD5c2514c216b4b6dac1a4d740126177f29
SHA1c25d7b051339c9d0b1ee109abfb12724a24f130d
SHA2568212f98e9caedd00bab3c3d561055507cd617cc2b2151c956968caeccde66e11
SHA512dfe6dab9e14b539e50eea2b8314f3937f650eded149d1264763ee4d0d045bf1959569cb31e9e7d5bf602e49c68401cde02e2e552ef3d0baca2e4d48c53d78692
-
Filesize
870KB
MD57f728acab22868ca02cc1ba0a14f5d64
SHA19e3e82b152447b8bcd27583fbdab7aa91ca4739d
SHA256586f9a9af50b2a3321e77d2b4583741cc4842967af9429cc371534f7179caec4
SHA5129bc8bb97e6d4f18ec484fcd792466cb5df0bf0447cbaa19a41258ef80e599e8a2b2c83c700f32f30bef578b03614af1b554844d051435dc9f510ccbd56686800
-
Filesize
41KB
MD5dc973050688bfd27a2d47e0ac2e21abb
SHA13ff84e8c292051aa7e57439aa44b7beac68b2d71
SHA256e69c437e565390cbc0209e7934136cc68a7caa07cf7341c870dac35ca549b225
SHA5124123df1cb903bff54897e1edd8c8c877e3fff9b81de9919569b3096fac8d80d06f73f005ef1c63269f4b50d7ee1965deb13d473b32f365c8324880ab995a600c