Overview
overview
10Static
static
10TotalAV_Setup.exe
windows7-x64
4TotalAV_Setup.exe
windows10-2004-x64
4$APPDATA/T...wf.dat
windows7-x64
3$APPDATA/T...wf.dat
windows10-2004-x64
3$APPDATA/T...wf.dat
windows7-x64
3$APPDATA/T...wf.dat
windows10-2004-x64
3$APPDATA/T...en.dat
windows7-x64
3$APPDATA/T...en.dat
windows10-2004-x64
3$APPDATA/T...wf.dat
windows7-x64
3$APPDATA/T...wf.dat
windows10-2004-x64
3$APPDATA/T...mv.dat
windows7-x64
3$APPDATA/T...mv.dat
windows10-2004-x64
3$APPDATA/T...db.dat
windows7-x64
3$APPDATA/T...db.dat
windows10-2004-x64
3$APPDATA/T...ce.dll
windows7-x64
3$APPDATA/T...ce.dll
windows10-2004-x64
3$APPDATA/T...wf.dat
windows7-x64
3$APPDATA/T...wf.dat
windows10-2004-x64
3$APPDATA/T...mv.dat
windows7-x64
3$APPDATA/T...mv.dat
windows10-2004-x64
3$APPDATA/T...et.dat
windows7-x64
3$APPDATA/T...et.dat
windows10-2004-x64
3$APPDATA/T...df.dat
windows7-x64
3$APPDATA/T...df.dat
windows10-2004-x64
3$APPDATA/T...e.conf
windows7-x64
3$APPDATA/T...e.conf
windows10-2004-x64
3$APPDATA/T...sg.avr
windows7-x64
3$APPDATA/T...sg.avr
windows10-2004-x64
3$APPDATA/T...rt.crt
windows7-x64
1$APPDATA/T...rt.crt
windows10-2004-x64
1$APPDATA/T...README
windows7-x64
1$APPDATA/T...README
windows10-2004-x64
1Resubmissions
07/08/2024, 12:20
240807-ph2rtsyejj 10Analysis
-
max time kernel
102s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07/08/2024, 12:20
Behavioral task
behavioral1
Sample
TotalAV_Setup.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
TotalAV_Setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aedroid_gwf.dat
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aedroid_gwf.dat
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeexp_gwf.dat
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeexp_gwf.dat
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur_agen.dat
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur_agen.dat
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur_gwf.dat
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur_gwf.dat
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur_mv.dat
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeheur_mv.dat
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aelidb.dat
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aelidb.dat
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeoffice.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeoffice.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeoffice_gwf.dat
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeoffice_gwf.dat
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeoffice_mv.dat
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeoffice_mv.dat
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeset.dat
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeset.dat
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aevdf.dat
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aevdf.dat
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/avupdate-savapilib-engine.conf
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/avupdate-savapilib-engine.conf
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/avupdate_msg.avr
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/avupdate_msg.avr
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/cacert.crt
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/cacert.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/README
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/on_access/README
Resource
win10v2004-20240802-en
General
-
Target
$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeset.dat
-
Size
3KB
-
MD5
4c9ed5bf916808f45ee25456f977f4b6
-
SHA1
bc3101b75755a91ee25b757c547c59b998deecc8
-
SHA256
2b897418cb59d00a89890c8c4c264ed383a24bf319b27043862ef952dee9a132
-
SHA512
21bdd8790afb37417119782c46c6caf6789d79fd2ed04959f546028518ba29183be6bde4fa76a8da66e1656bc9b339e3f8c0f9b46eb77c77c26fea0fcee64fb3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\dat_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\dat_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\dat_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\dat_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\.dat rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\.dat\ = "dat_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\dat_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2688 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2688 AcroRd32.exe 2688 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2956 2232 cmd.exe 31 PID 2232 wrote to memory of 2956 2232 cmd.exe 31 PID 2232 wrote to memory of 2956 2232 cmd.exe 31 PID 2956 wrote to memory of 2688 2956 rundll32.exe 32 PID 2956 wrote to memory of 2688 2956 rundll32.exe 32 PID 2956 wrote to memory of 2688 2956 rundll32.exe 32 PID 2956 wrote to memory of 2688 2956 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.1\aeset.dat"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.1\aeset.dat2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.1\aeset.dat"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2688
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD57fc3167e4adaedb3246189188a453834
SHA1bae8e54fab15ff5ff7ac743b6acf3f73b6dce0b3
SHA256a5c4bdba36c1b75f2d36cec762392a8af500c9b84cf0da0f5ba46eeb6c605478
SHA5122ab9e72a30b090a87c817b94ba753c38490d40325b654483f73c85a74b8b6835582404765048c04d2bdb7bedc3fe81a3ee11fde43be04515a3951bb53c7c26c3