1786d9bdb752a866bba3beaa27f0b6e635e4c6449bcc32105539551758186492

Analysis

max time kernel
12s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 03:37

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

AntivirusDefender-main/AntivirusDefender/AntivirusDefender/obj/Debug/AntivirusDefender.exe
Size

10.6MB
MD5

7acbd34db0aa98d2a0cc3ea8716b12b5
SHA1

842d24df65449d5722b387f0a28cb746cf615e69
SHA256

3bdab09c77fda2c0afe9cafd76202cd33f9a1d7adee9e437a931d2ba366ebf87
SHA512

1f564735bb1596a6ba5d1b6654fc3b90a9707117b048d54a1c54324eea5d634dbcfbdff366ef1d65598507660295008f8434054c3f53412cacf49c55aff208d2
SSDEEP

196608:DbxNMGrnhzvYf9EfmiAf1qkB8I9r1UhraBMBMBR:bMGr4+BAf1qC1caBMWBR

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AntivirusDefender.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	AntivirusDefender.exe

Executes dropped EXE 1 IoCs

pid	Process
2360	antivirusfalsepositivetest3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyStartupValuex = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AntivirusDefender-main\\AntivirusDefender\\AntivirusDefender\\obj\\Debug\\antivirusfalsepositivetest4.exe"	AntivirusDefender.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyStartupValue = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AntivirusDefender-main\\AntivirusDefender\\AntivirusDefender\\obj\\Debug\\antivirusfalsepositivetest4.exe"	antivirusfalsepositivetest3.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AntivirusDefender.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AntivirusDefender.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe
3984	AntivirusDefender.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3564	shutdown.exe
Token: SeRemoteShutdownPrivilege	3564	shutdown.exe
Token: SeDebugPrivilege	3984	AntivirusDefender.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 3564	3984	AntivirusDefender.exe	84
PID 3984 wrote to memory of 3564	3984	AntivirusDefender.exe	84
PID 3984 wrote to memory of 3564	3984	AntivirusDefender.exe	84
PID 3984 wrote to memory of 2804	3984	AntivirusDefender.exe	87
PID 3984 wrote to memory of 2804	3984	AntivirusDefender.exe	87
PID 3984 wrote to memory of 2804	3984	AntivirusDefender.exe	87
PID 3984 wrote to memory of 2360	3984	AntivirusDefender.exe	89
PID 3984 wrote to memory of 2360	3984	AntivirusDefender.exe	89
PID 3984 wrote to memory of 2360	3984	AntivirusDefender.exe	89
PID 3984 wrote to memory of 4296	3984	AntivirusDefender.exe	90
PID 3984 wrote to memory of 4296	3984	AntivirusDefender.exe	90
PID 3984 wrote to memory of 4296	3984	AntivirusDefender.exe	90
PID 3984 wrote to memory of 3188	3984	AntivirusDefender.exe	92
PID 3984 wrote to memory of 3188	3984	AntivirusDefender.exe	92
PID 3984 wrote to memory of 3188	3984	AntivirusDefender.exe	92

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AntivirusDefender.exe

C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\AntivirusDefender.exe
"C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\AntivirusDefender.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3984
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /r /t 30
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest3.exe" "C:\Users\Admin\defender.exe" & pause
  2⤵
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest3.exe
  "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest3.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest3.exe" "C:\Users\Admin\antivirusfalsepositivetest3.exe" & pause
  2⤵
  PID:4296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest4.exe" "C:\Users\Admin\antivirusfalsepositivetest4.exe" & pause
  2⤵
  PID:3188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\usbwrite.exe" "C:\Users\Admin\usbwrite.exe" & pause
  2⤵
  PID:3928

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39af055 /state1:0x41c64e6d
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest3.exe

Filesize
17KB

MD5
05a9d377f26e6c48b167f64fd802899b

SHA1
90dc58c88d853ea53fcd54410f0cc7c5fd393f05

SHA256
47c889dd63190f07f54b7f3db663a1fb54c1fa981caab5b627885ac92b156337

SHA512
aa728441651b381442f09b7188349f926aec5f5ce57226d620aec7210ec19ba32ad52cf9a75cf71180041b5ee87b0245ad5534e4e738a4d174a1fc5f2a04afb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\obj\Debug\antivirusfalsepositivetest4.exe

Filesize
10.1MB

MD5
97f44c7df82adc19ce025cfc8958245c

SHA1
699fb553ea85db7c6c5fc5118ab7a1a0c3b19602

SHA256
0fc9a98ed6bad1f94e0357b6bb833b4eca20bea119abc0cdfa3bb4caeeddcda1

SHA512
e2da423ba4eee8f4e836f5eeed82bfe9cf482a911200f805dcdff20d41901c73b40faf187c66ef2e32f9ec8f6d565c43f38229c026285dd0411d4c1c8c22c27e

Download Submit
memory/2360-22-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/2360-38-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/2360-36-0x0000000005170000-0x0000000005180000-memory.dmp

Filesize
64KB

Download
memory/2360-35-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/2360-20-0x00000000006A0000-0x00000000006AA000-memory.dmp

Filesize
40KB

Download
memory/2360-23-0x0000000005170000-0x0000000005180000-memory.dmp

Filesize
64KB

Download
memory/3984-4-0x0000000005DD0000-0x0000000005DE0000-memory.dmp

Filesize
64KB

Download
memory/3984-5-0x0000000005E00000-0x0000000005E0A000-memory.dmp

Filesize
40KB

Download
memory/3984-0-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/3984-29-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/3984-30-0x0000000005DD0000-0x0000000005DE0000-memory.dmp

Filesize
64KB

Download
memory/3984-3-0x0000000005E40000-0x0000000005ED2000-memory.dmp

Filesize
584KB

Download
memory/3984-2-0x00000000063F0000-0x0000000006994000-memory.dmp

Filesize
5.6MB

Download
memory/3984-37-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/3984-1-0x00000000009A0000-0x0000000001436000-memory.dmp

Filesize
10.6MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads