f585210da745a18123b21e4840958b735086b230c37e3ba912aff048826ff114

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

norton/Norton 2011 TrialReset v3.1.0.exe
Size

2.2MB
MD5

86a7610a736a68246a4bd8b7f225f7c7
SHA1

a8575f13280e627aa189ecc096ac6ba78ba86e4a
SHA256

25b9feac6c3516cbee34a69b5cbbc4ef2a0362f7b3a7c22e12504fbab7813642
SHA512

0fdd55e0e7239caf412f54e2c3b40217bab131b16e6e9c159bbb815b610ef509f01604ca397984ae79e4f9fa3aff289158b41a9c5bd0a584d04798ca23cdc152
SSDEEP

49152:iD0tM85DJjl/i/jmi2oQ55+ug230U2+QJgxa9OjtFQZFm7N:dKeDBgai2F5/gE0UEJgEMZFQZ0N

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral20/memory/3404-0-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral20/memory/3404-8-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral20/memory/3404-9-0x0000000000400000-0x00000000004C1000-memory.dmp	upx

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral20/memory/3404-8-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral20/memory/3404-9-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3404	Norton 2011 TrialReset v3.1.0.exe
3404	Norton 2011 TrialReset v3.1.0.exe
3404	Norton 2011 TrialReset v3.1.0.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3404	Norton 2011 TrialReset v3.1.0.exe
3404	Norton 2011 TrialReset v3.1.0.exe
3404	Norton 2011 TrialReset v3.1.0.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1704	3404	Norton 2011 TrialReset v3.1.0.exe	92
PID 3404 wrote to memory of 1704	3404	Norton 2011 TrialReset v3.1.0.exe	92
PID 3404 wrote to memory of 1704	3404	Norton 2011 TrialReset v3.1.0.exe	92
PID 1704 wrote to memory of 1672	1704	cmd.exe	94
PID 1704 wrote to memory of 1672	1704	cmd.exe	94
PID 1704 wrote to memory of 1672	1704	cmd.exe	94
PID 3404 wrote to memory of 3916	3404	Norton 2011 TrialReset v3.1.0.exe	95
PID 3404 wrote to memory of 3916	3404	Norton 2011 TrialReset v3.1.0.exe	95
PID 3404 wrote to memory of 3916	3404	Norton 2011 TrialReset v3.1.0.exe	95
PID 3916 wrote to memory of 896	3916	cmd.exe	97
PID 3916 wrote to memory of 896	3916	cmd.exe	97
PID 3916 wrote to memory of 896	3916	cmd.exe	97
PID 3404 wrote to memory of 1928	3404	Norton 2011 TrialReset v3.1.0.exe	98
PID 3404 wrote to memory of 1928	3404	Norton 2011 TrialReset v3.1.0.exe	98
PID 3404 wrote to memory of 1928	3404	Norton 2011 TrialReset v3.1.0.exe	98
PID 1928 wrote to memory of 4056	1928	cmd.exe	100
PID 1928 wrote to memory of 4056	1928	cmd.exe	100
PID 1928 wrote to memory of 4056	1928	cmd.exe	100
PID 3404 wrote to memory of 4992	3404	Norton 2011 TrialReset v3.1.0.exe	101
PID 3404 wrote to memory of 4992	3404	Norton 2011 TrialReset v3.1.0.exe	101
PID 3404 wrote to memory of 4992	3404	Norton 2011 TrialReset v3.1.0.exe	101
PID 4992 wrote to memory of 4764	4992	cmd.exe	103
PID 4992 wrote to memory of 4764	4992	cmd.exe	103
PID 4992 wrote to memory of 4764	4992	cmd.exe	103
PID 3404 wrote to memory of 3208	3404	Norton 2011 TrialReset v3.1.0.exe	104
PID 3404 wrote to memory of 3208	3404	Norton 2011 TrialReset v3.1.0.exe	104
PID 3404 wrote to memory of 3208	3404	Norton 2011 TrialReset v3.1.0.exe	104
PID 3208 wrote to memory of 1564	3208	cmd.exe	106
PID 3208 wrote to memory of 1564	3208	cmd.exe	106
PID 3208 wrote to memory of 1564	3208	cmd.exe	106
PID 3404 wrote to memory of 4788	3404	Norton 2011 TrialReset v3.1.0.exe	107
PID 3404 wrote to memory of 4788	3404	Norton 2011 TrialReset v3.1.0.exe	107
PID 3404 wrote to memory of 4788	3404	Norton 2011 TrialReset v3.1.0.exe	107
PID 4788 wrote to memory of 3728	4788	cmd.exe	109
PID 4788 wrote to memory of 3728	4788	cmd.exe	109
PID 4788 wrote to memory of 3728	4788	cmd.exe	109
PID 3404 wrote to memory of 2880	3404	Norton 2011 TrialReset v3.1.0.exe	110
PID 3404 wrote to memory of 2880	3404	Norton 2011 TrialReset v3.1.0.exe	110
PID 3404 wrote to memory of 2880	3404	Norton 2011 TrialReset v3.1.0.exe	110
PID 2880 wrote to memory of 2772	2880	cmd.exe	112
PID 2880 wrote to memory of 2772	2880	cmd.exe	112
PID 2880 wrote to memory of 2772	2880	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\norton\Norton 2011 TrialReset v3.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\norton\Norton 2011 TrialReset v3.1.0.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MSSYCLM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MSSYCLM /f
    3⤵
    PID:1672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eeCtrl /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eeCtrl /f
    3⤵
    PID:896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EraserUtilDrv10910 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EraserUtilDrv10910 /f
    3⤵
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EraserUtilRebootDrv /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EraserUtilRebootDrv /f
    3⤵
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Norton /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Norton /f
    3⤵
    PID:1564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG DELETE HKEY_CURRENT_USER\Software\Norton /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE HKEY_CURRENT_USER\Software\Norton /f
    3⤵
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\SymNRT /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\SymNRT /f
    3⤵
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3404-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3404-8-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3404-9-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download