Overview

overview

8

Static

static

3

AviraPhant...08.exe

windows7-x64

8

AviraPhant...08.exe

windows10-2004-x64

8

AviraPhant...on.cmd

windows7-x64

8

AviraPhant...on.cmd

windows10-2004-x64

8

Analysis

  • max time kernel
    140s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    14/06/2024, 00:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AviraPhantomVPNPro/Avira Phantom VPN Pro/Silent Installation.cmd
  • Size 803B
  • Sample240614-agbrpaxarc
  • SHA256 be3dda89063e6e6cefba5c8242bb33f0979a7cf2bf09cbe47ff2ee8f62a217d5
  • MD5 SHA1 SHA512
Score
8/10
discoveryevasionexecution

Malware Config

Signatures

  • Stops running service(s) 4 TTPs
    evasionexecution
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies data under HKEY_USERS 51 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\AviraPhantomVPNPro\Avira Phantom VPN Pro\Silent Installation.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Users\Admin\AppData\Local\Temp\AviraPhantomVPNPro\Avira Phantom VPN Pro\Avira Phantom VPN Pro 2.44.1.19908.exe
      "Avira Phantom VPN Pro 2.44.1.19908.exe" /VERYSILENT
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Users\Admin\AppData\Local\Temp\is-Q8GIC.tmp\Avira Phantom VPN Pro 2.44.1.19908.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-Q8GIC.tmp\Avira Phantom VPN Pro 2.44.1.19908.tmp" /SL5="$60120,4884611,248832,C:\Users\Admin\AppData\Local\Temp\AviraPhantomVPNPro\Avira Phantom VPN Pro\Avira Phantom VPN Pro 2.44.1.19908.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\System32\taskkill.exe" /f /im Avira.WebAppHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2352
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\System32\taskkill.exe" /f /im Avira.VPN.Notifier.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3044
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\System32\taskkill.exe" /f /im Avira.NetworkBlocker.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2652
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" stop AviraPhantomVPN
          4⤵
          • Launches sc.exe
          PID:2660
        • C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win7\amd64\tapinstall.exe
          "C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win7\amd64\tapinstall.exe" install "C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win7\amd64\OemVista.inf" "phantomtap"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          PID:1928
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1a5eef8e-4821-2809-db8a-a04f9f157f73}\oemvista.inf" "9" "657afe35b" "00000000000003B8" "WinSta0\Default" "0000000000000494" "208" "c:\program files (x86)\avira\vpn\openvpn\tap\win7\amd64"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{07e924ca-698e-719b-02a5-7a0591da386f} Global\{130a300b-c984-5d60-513a-d058b8931203} C:\Windows\System32\DriverStore\Temp\{060da7fc-b826-1251-142e-506a6031ff7b}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{060da7fc-b826-1251-142e-506a6031ff7b}\phantomtap.cat
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:760

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        is-NT1SP.tmp
        • Path C:\Program Files (x86)\Avira\VPN\App\images\png\regions\is-NT1SP.tmp
        • Size 743B
        • SHA256 3cf52e677d7f7be201cbf6e3ec56ed1f48b95c47e5969ef2c2510e270133c4f0
        • MD5 SHA1 SHA512
        Submit Download

        OemVista.inf
        • Path C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win7\amd64\OemVista.inf
        • Size 7KB
        • SHA256 427f9551921202143ba72f8d3abec45ad7c887a827fac2864a501551ce309685
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Cab2C60.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\Cab2C60.tmp
        • Size 68KB
        • SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Tar2C72.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\Tar2C72.tmp
        • Size 177KB
        • SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira Phantom VPN Pro 2.44.1.19908.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-Q8GIC.tmp\Avira Phantom VPN Pro 2.44.1.19908.tmp
        • Size 1.5MB
        • SHA256 02febfffcac96296e9cbad84cccf0153a11c051e0f2421e86360eccfc21f7f4d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Cab2EEF.tmp
        • Path C:\Windows\Temp\Cab2EEF.tmp
        • Size 29KB
        • SHA256 a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Tar2F40.tmp
        • Path C:\Windows\Temp\Tar2F40.tmp
        • Size 81KB
        • SHA256 725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PHANTO~1.SYS
        • Path \??\c:\PROGRA~2\avira\vpn\openvpn\tap\win7\amd64\PHANTO~1.SYS
        • Size 38KB
        • SHA256 f2414bfba1c8a4fd2cafa0695832886a7f4cbad9a0d9e2e6c13f6e4803bfc604
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        phantomtap.cat
        • Path \??\c:\program files (x86)\avira\vpn\openvpn\tap\win7\amd64\phantomtap.cat
        • Size 9KB
        • SHA256 23fa82d166e5ea49da9ea65683e9df0544d9b3012e725ac528e6cd0ccb37ce14
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.WebAppHost.exe
        • Path \Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe
        • Size 815KB
        • SHA256 0a2d4aaab11291d99542e74689bc6265bb2a7922d8870167bdcc3210f0627273
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tapinstall.exe
        • Path \Program Files (x86)\Avira\VPN\OpenVpn\TAP\win7\amd64\tapinstall.exe
        • Size 482KB
        • SHA256 85ab4bbb77ab248956d0da02ace1a2bc58ce6c6db9f421808ef03ed31bbcf3b6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        unins000.exe
        • Path \Program Files (x86)\Avira\VPN\unins000.exe
        • Size 1.5MB
        • SHA256 7597b3dbf0fce4d5ce61285d7702f067e04c00025f6ae6e9378227b060ab4cef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _shfoldr.dll
        • Path \Users\Admin\AppData\Local\Temp\is-2G8K7.tmp\_isetup\_shfoldr.dll
        • Size 22KB
        • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2132-8-0x0000000000400000-0x0000000000593000-memory.dmp
        Download

        memory/2132-1077-0x0000000000400000-0x0000000000593000-memory.dmp
        Download

        memory/3052-0-0x0000000000400000-0x0000000000447000-memory.dmp
        Download

        memory/3052-2-0x0000000000401000-0x0000000000417000-memory.dmp
        Download

        memory/3052-1076-0x0000000000400000-0x0000000000447000-memory.dmp
        Download