0c8ec6b3108602dc7ec85538d47c2c26b17ade8cf73022eaf1852654fca3803a

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

avgdiagex.exe
Size

2.8MB
MD5

79a60194b00b59777dd7539fb49f0a1e
SHA1

b2c04a1f13268371ca53c4c752aa2bc4fd8a0de3
SHA256

b54be97cff2ff0c114e1e3ff846f65e2dd085922f4df4dbb9c5845b2944aa1bb
SHA512

0bf8119e4b2bf2afdf28b2f682d9f120e5b6da432d3d2df95158b58f341e4fb90fbd7dafffa5a39424a8abee5bb6912411ca34e0e2758caad5610d794f299a81
SSDEEP

49152:knI3JLy/Q2NEdLdyCCTem+g691KHkxQnTwiJIV4jJlUzvPsU2Eo:kI3JLy/QvdLdsgmHCyom3

Score

6^/10

discovery evasion lateral_movement trojan

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

avgdiagex.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA avgdiagex.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	avgdiagex.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

avgdiagex.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	avgdiagex.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	avgdiagex.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count	avgdiagex.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\NextInstance	avgdiagex.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	avgdiagex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	avgdiagex.exe

Remote Services: SMB/Windows Admin Shares 1 TTPs 1 IoCs
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
lateral_movement

SMB/Windows Admin Shares
T1021.002

Processes:

avgdiagex.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LanmanServer\Parameters\NullSessionPipes avgdiagex.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

avgdiagex.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avgdiagex.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LanmanServer\Parameters\NullSessionPipes	avgdiagex.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avgdiagex.exe

Modifies registry class 2 IoCs

Processes:

avgdiagex.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2A563CC5-118B-20E8-A494-3B67AD4F7D9C}	avgdiagex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2A563CC5-118B-20E8-A494-3B67AD4F7D9C} \data = "f3031820a53d47c6962e230c8048aadc"	avgdiagex.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

avgdiagex.exe

pid process

2400 avgdiagex.exe
2400 avgdiagex.exe
2400 avgdiagex.exe
2400 avgdiagex.exe
2400 avgdiagex.exe
2400 avgdiagex.exe
2400 avgdiagex.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

avgdiagex.exe

description pid process

Token: SeSecurityPrivilege 2400 avgdiagex.exe

pid	process
2400	avgdiagex.exe
2400	avgdiagex.exe
2400	avgdiagex.exe
2400	avgdiagex.exe
2400	avgdiagex.exe
2400	avgdiagex.exe
2400	avgdiagex.exe

description	pid	process
Token: SeSecurityPrivilege	2400	avgdiagex.exe

C:\Users\Admin\AppData\Local\Temp\avgdiagex.exe
"C:\Users\Admin\AppData\Local\Temp\avgdiagex.exe"
1⤵
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Remote Services: SMB/Windows Admin Shares
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

SMB/Windows Admin Shares

T1021.002

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Avg2013\log\avgdiagex.log.1
Filesize
64KB

MD5
7aef6425f35e56c436e5533fdcb515f0

SHA1
ec567509a95e944bb93c14d231da779609b86555

SHA256
4365f0e9484ef4008a95aaa4b2cf9424135177b959e927459dd93e44a7609f5a

SHA512
5a6496297de233cbca7d4cd8fac15c03b219343b85f86fd0774a0dc2dc570e89375e74b31ce60a9a7fb806c886e4f51fa6a3dd8a6f5a019b37b258d55e25c89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\avgdiag2\1f42920b-798d-4e09-bcc1-cf18363dce46\1f42920b-798d-4e09-bcc1-cf18363dce46[f3031820-a53d-47c6-962e-230c8048aadc].txt
Filesize
612B

MD5
5032d60ef90f3564fa8a5f4819f885f8

SHA1
687ce3b15218feb39469feab22839a65bea35f0a

SHA256
fe0482ce5dd51c25d357f4bd92bcb6d630e161fab43c9d2b480dd1435c490cb3

SHA512
e612930b3ec20bb1c1ba7388336fb0ab1ce3b9ada4ad7ed829845a4967066eba7509e695e3fea5e87968dc943b1d4975abb01f381e9870c93d53ef827cdd7d98

Download Submit
C:\Users\Admin\AppData\Local\Temp\avgdiag2\1f42920b-798d-4e09-bcc1-cf18363dce46\out\1f42920b-798d-4e09-bcc1-cf18363dce46[f3031820-a53d-47c6-962e-230c8048aadc].zip
Filesize
409KB

MD5
65bc0e3b8223bfee52112efcd2c27a8d

SHA1
e5139e70c98f2cfc9c8bfb9fb5d1abeec1ec10ed

SHA256
b8e76931ea56f87c6da7f8fd6a25fe3e0c2e5da0ea1b50a0c92184adc6701a57

SHA512
5090eb82bb07141cf9d5a362d47b19d76159277518d589feca7fa25bdf9fe4f6e8f0776cfb3bca86f86dd8deeebdb134cdc56f5c5a1f06829fde1af6d166a466

Download Submit