b0db11cb8d232f65a27118734a477a2b3d3f0d5e8170f966ba82309cd437c114 | Triage

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

AVG Anti-Spyware/1)install.bat
Size

127B
MD5

f361f05865fd277c790aa64a65b864cd
SHA1

9d0dcb55892299748dd39d2dbb6c735caf7cf8a1
SHA256

e1d82943f10ebc7b3fc2f6a66280535936640dc26395a445b8f937eed72900aa
SHA512

71e8f0dc5e39b73e2f2431aa33ef0f6a74646286be65de7819b08cdbfe161ee1f0896bb3524d4b6bbf93a5b02293c7ad318c1b5c1ae254f561103edb3629ccb7

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\AvgAsC64.sys	guard.exe
File created	C:\Windows\system32\DRIVERS\AvgAsC64.sys	guard.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5036	guard.exe
5036	guard.exe
5036	guard.exe
5036	guard.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	5036	guard.exe
Token: SeDebugPrivilege	5036	guard.exe
Token: SeDebugPrivilege	5036	guard.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 4160	1844	cmd.exe	81
PID 1844 wrote to memory of 4160	1844	cmd.exe	81
PID 1844 wrote to memory of 4160	1844	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AVG Anti-Spyware\1)install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\AVG Anti-Spyware\guard.exe
  guard /install
  2⤵
  - Drops file in Drivers directory
  PID:4160

C:\Users\Admin\AppData\Local\Temp\AVG Anti-Spyware\guard.exe
"C:\Users\Admin\AppData\Local\Temp\AVG Anti-Spyware\guard.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads