1786d9bdb752a866bba3beaa27f0b6e635e4c6449bcc32105539551758186492

Analysis

max time kernel
25s
max time network
36s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 03:37

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

AntivirusDefender-main/AntivirusDefender/AntivirusDefender/obj/Debug/AntivirusDefender.exe
Size

10.6MB
MD5

7acbd34db0aa98d2a0cc3ea8716b12b5
SHA1

842d24df65449d5722b387f0a28cb746cf615e69
SHA256

3bdab09c77fda2c0afe9cafd76202cd33f9a1d7adee9e437a931d2ba366ebf87
SHA512

1f564735bb1596a6ba5d1b6654fc3b90a9707117b048d54a1c54324eea5d634dbcfbdff366ef1d65598507660295008f8434054c3f53412cacf49c55aff208d2
SSDEEP

196608:DbxNMGrnhzvYf9EfmiAf1qkB8I9r1UhraBMBMBR:bMGr4+BAf1qC1caBMWBR

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AntivirusDefender.exe

Executes dropped EXE 1 IoCs

pid	Process
2688	antivirusfalsepositivetest3.exe

Loads dropped DLL 1 IoCs

pid	Process
3048	AntivirusDefender.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyStartupValuex = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AntivirusDefender-main\\AntivirusDefender\\AntivirusDefender\\obj\\Debug\\antivirusfalsepositivetest4.exe"	AntivirusDefender.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyStartupValue = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AntivirusDefender-main\\AntivirusDefender\\AntivirusDefender\\obj\\Debug\\antivirusfalsepositivetest4.exe"	antivirusfalsepositivetest3.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AntivirusDefender.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AntivirusDefender.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe
3048	AntivirusDefender.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2016	shutdown.exe
Token: SeRemoteShutdownPrivilege	2016	shutdown.exe
Token: SeDebugPrivilege	3048	AntivirusDefender.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2016	3048	AntivirusDefender.exe	28
PID 3048 wrote to memory of 2016	3048	AntivirusDefender.exe	28
PID 3048 wrote to memory of 2016	3048	AntivirusDefender.exe	28
PID 3048 wrote to memory of 2016	3048	AntivirusDefender.exe	28
PID 3048 wrote to memory of 2792	3048	AntivirusDefender.exe	31
PID 3048 wrote to memory of 2792	3048	AntivirusDefender.exe	31
PID 3048 wrote to memory of 2792	3048	AntivirusDefender.exe	31
PID 3048 wrote to memory of 2792	3048	AntivirusDefender.exe	31
PID 3048 wrote to memory of 2688	3048	AntivirusDefender.exe	33
PID 3048 wrote to memory of 2688	3048	AntivirusDefender.exe	33
PID 3048 wrote to memory of 2688	3048	AntivirusDefender.exe	33
PID 3048 wrote to memory of 2688	3048	AntivirusDefender.exe	33
PID 3048 wrote to memory of 2652	3048	AntivirusDefender.exe	34
PID 3048 wrote to memory of 2652	3048	AntivirusDefender.exe	34
PID 3048 wrote to memory of 2652	3048	AntivirusDefender.exe	34
PID 3048 wrote to memory of 2652	3048	AntivirusDefender.exe	34
PID 3048 wrote to memory of 2160	3048	AntivirusDefender.exe	36
PID 3048 wrote to memory of 2160	3048	AntivirusDefender.exe	36
PID 3048 wrote to memory of 2160	3048	AntivirusDefender.exe	36
PID 3048 wrote to memory of 2160	3048	AntivirusDefender.exe	36
PID 3048 wrote to memory of 1584	3048	AntivirusDefender.exe	38
PID 3048 wrote to memory of 1584	3048	AntivirusDefender.exe	38
PID 3048 wrote to memory of 1584	3048	AntivirusDefender.exe	38
PID 3048 wrote to memory of 1584	3048	AntivirusDefender.exe	38

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AntivirusDefender.exe

C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\AntivirusDefender.exe
"C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\AntivirusDefender.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3048
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /r /t 30
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest3.exe" "C:\Users\Admin\defender.exe" & pause
  2⤵
  PID:2792
- C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest3.exe
  "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest3.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest3.exe" "C:\Users\Admin\antivirusfalsepositivetest3.exe" & pause
  2⤵
  PID:2652
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest4.exe" "C:\Users\Admin\antivirusfalsepositivetest4.exe" & pause
  2⤵
  PID:2160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\usbwrite.exe" "C:\Users\Admin\usbwrite.exe" & pause
  2⤵
  PID:1584
- C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest3.exe
  "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest3.exe"
  2⤵
  PID:296

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:312

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest3.exe

Filesize
17KB

MD5
05a9d377f26e6c48b167f64fd802899b

SHA1
90dc58c88d853ea53fcd54410f0cc7c5fd393f05

SHA256
47c889dd63190f07f54b7f3db663a1fb54c1fa981caab5b627885ac92b156337

SHA512
aa728441651b381442f09b7188349f926aec5f5ce57226d620aec7210ec19ba32ad52cf9a75cf71180041b5ee87b0245ad5534e4e738a4d174a1fc5f2a04afb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest4.exe

Filesize
10.1MB

MD5
97f44c7df82adc19ce025cfc8958245c

SHA1
699fb553ea85db7c6c5fc5118ab7a1a0c3b19602

SHA256
0fc9a98ed6bad1f94e0357b6bb833b4eca20bea119abc0cdfa3bb4caeeddcda1

SHA512
e2da423ba4eee8f4e836f5eeed82bfe9cf482a911200f805dcdff20d41901c73b40faf187c66ef2e32f9ec8f6d565c43f38229c026285dd0411d4c1c8c22c27e

Download Submit
memory/2688-9-0x00000000000C0000-0x00000000000CA000-memory.dmp

Filesize
40KB

Download
memory/3048-0-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/3048-1-0x0000000000910000-0x00000000013A6000-memory.dmp

Filesize
10.6MB

Download
memory/3048-2-0x00000000057E0000-0x0000000005820000-memory.dmp

Filesize
256KB

Download
memory/3048-20-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/3048-21-0x00000000057E0000-0x0000000005820000-memory.dmp

Filesize
256KB

Download
memory/3048-24-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads