Overview
overview
10Static
static
10ScanGuard_Setup.exe
windows11-21h2-x64
$APPDATA/S...te.exe
windows11-21h2-x64
1$APPDATA/S...io.dll
windows11-21h2-x64
3$APPDATA/S...lt.sys
windows11-21h2-x64
1$APPDATA/S...bb.sys
windows11-21h2-x64
1$APPDATA/S...gr.sys
windows11-21h2-x64
1$APPDATA/S...io.dll
windows11-21h2-x64
3$APPDATA/S...lt.sys
windows11-21h2-x64
1$APPDATA/S...bb.sys
windows11-21h2-x64
1$APPDATA/S...gr.sys
windows11-21h2-x64
$APPDATA/S...io.dll
windows11-21h2-x64
3$APPDATA/S...lt.sys
windows11-21h2-x64
1$APPDATA/S...bb.sys
windows11-21h2-x64
1$APPDATA/S...gr.sys
windows11-21h2-x64
1$APPDATA/S...io.dll
windows11-21h2-x64
3$APPDATA/S...lt.sys
windows11-21h2-x64
1Microsoft....cs.dll
windows11-21h2-x64
1Microsoft....es.dll
windows11-21h2-x64
1Microsoft....er.dll
windows11-21h2-x64
1Microsoft.CSharp.dll
windows11-21h2-x64
1Microsoft....86.dll
windows11-21h2-x64
1Microsoft....ns.dll
windows11-21h2-x64
1Microsoft....er.dll
windows11-21h2-x64
1Microsoft....on.dll
windows11-21h2-x64
1Microsoft....ns.dll
windows11-21h2-x64
1Microsoft....on.dll
windows11-21h2-x64
1Microsoft....ns.dll
windows11-21h2-x64
1Microsoft....ng.dll
windows11-21h2-x64
1Microsoft....ns.dll
windows11-21h2-x64
1Microsoft....es.dll
windows11-21h2-x64
1Microsoft....ns.dll
windows11-21h2-x64
1Microsoft....re.dll
windows11-21h2-x64
1Resubmissions
10-07-2024 23:05
240710-223vfsvemm 10Analysis
-
max time kernel
1790s -
max time network
1805s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-07-2024 23:05
Behavioral task
behavioral1
Sample
ScanGuard_Setup.exe
Resource
win11-20240709-en
Behavioral task
behavioral2
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/avupdate.exe
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win7/avgio.dll
Resource
win11-20240709-en
Behavioral task
behavioral4
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win7/avgntflt.sys
Resource
win11-20240709-en
Behavioral task
behavioral5
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win7/avipbb.sys
Resource
win11-20240709-en
Behavioral task
behavioral6
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win7/avkmgr.sys
Resource
win11-20240709-en
Behavioral task
behavioral7
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win8/avgio.dll
Resource
win11-20240709-en
Behavioral task
behavioral8
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.sys
Resource
win11-20240709-en
Behavioral task
behavioral9
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.sys
Resource
win11-20240709-en
Behavioral task
behavioral10
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.sys
Resource
win11-20240709-en
Behavioral task
behavioral11
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win64/win7/avgio.dll
Resource
win11-20240709-en
Behavioral task
behavioral12
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win64/win7/avgntflt.sys
Resource
win11-20240709-en
Behavioral task
behavioral13
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win64/win7/avipbb.sys
Resource
win11-20240709-en
Behavioral task
behavioral14
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win64/win7/avkmgr.sys
Resource
win11-20240709-en
Behavioral task
behavioral15
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win64/win8/avgio.dll
Resource
win11-20240709-en
Behavioral task
behavioral16
Sample
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.sys
Resource
win11-20240709-en
Behavioral task
behavioral17
Sample
Microsoft.AppCenter.Analytics.dll
Resource
win11-20240709-en
Behavioral task
behavioral18
Sample
Microsoft.AppCenter.Crashes.dll
Resource
win11-20240709-en
Behavioral task
behavioral19
Sample
Microsoft.AppCenter.dll
Resource
win11-20240709-en
Behavioral task
behavioral20
Sample
Microsoft.CSharp.dll
Resource
win11-20240709-en
Behavioral task
behavioral21
Sample
Microsoft.DiaSymReader.Native.x86.dll
Resource
win11-20240709-en
Behavioral task
behavioral22
Sample
Microsoft.Extensions.Configuration.Abstractions.dll
Resource
win11-20240709-en
Behavioral task
behavioral23
Sample
Microsoft.Extensions.Configuration.Binder.dll
Resource
win11-20240709-en
Behavioral task
behavioral24
Sample
Microsoft.Extensions.Configuration.dll
Resource
win11-20240709-en
Behavioral task
behavioral25
Sample
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Resource
win11-20240709-en
Behavioral task
behavioral26
Sample
Microsoft.Extensions.DependencyInjection.dll
Resource
win11-20240709-en
Behavioral task
behavioral27
Sample
Microsoft.Extensions.Logging.Abstractions.dll
Resource
win11-20240709-en
Behavioral task
behavioral28
Sample
Microsoft.Extensions.Logging.dll
Resource
win11-20240709-en
Behavioral task
behavioral29
Sample
Microsoft.Extensions.Options.dll
Resource
win11-20240709-en
Behavioral task
behavioral30
Sample
Microsoft.Extensions.Primitives.dll
Resource
win11-20240709-en
Behavioral task
behavioral31
Sample
Microsoft.Toolkit.Uwp.Notifications.dll
Resource
win11-20240709-en
Behavioral task
behavioral32
Sample
Microsoft.VisualBasic.Core.dll
Resource
win11-20240709-en
General
-
Target
$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.sys
-
Size
196KB
-
MD5
18ed8302d083dad602823988a304a4f6
-
SHA1
01014fd10d7babd6d81bb7e9511ffa7e13c890fa
-
SHA256
629da28ac97f5b17b1603059242088727e1552d68fe350f97fcd0b67d412ab25
-
SHA512
de9ea04221fb1270db37d35fcc1acdf7265103e079fd31566b0a043a1fa3b2267a034b720a3070538f289fd3847171d3d54277417ba0f67aede86f1b78db220d
-
SSDEEP
3072:FiRnqR7d4wgBQIFnh/Lpx211rrYQwKiYB+Qua7KjoLxkAAFP:Fiq4PbL/2THYQwK7B+Bau0S
Malware Config
Signatures
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\on_access\win32\win8\avipbb.sys"1⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\on_access\win32\win8\avipbb.sys"C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\on_access\win32\win8\avipbb.sys"2⤵PID:2696
-