Resubmissions
14-10-2024 13:09
241014-qd9sbawhrb 1014-10-2024 13:03
241014-qagx5a1crn 1014-10-2024 12:59
241014-p76gba1ckm 1014-10-2024 12:57
241014-p63zsswfjd 1014-10-2024 12:55
241014-p52qcawepe 314-10-2024 12:54
241014-p4832awelh 314-10-2024 12:52
241014-p35dfswejd 10Analysis
-
max time kernel
39s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2024 12:52
Static task
static1
Behavioral task
behavioral1
Sample
AvastSvcZEg/AvastSvc.exe
Resource
win10v2004-20241007-en
General
-
Target
AvastSvcZEg/AvastSvc.exe
-
Size
60KB
-
MD5
a72036f635cecf0dcb1e9c6f49a8fa5b
-
SHA1
049813b955db1dd90952657ae2bd34250153563e
-
SHA256
85ca20eeec3400c68a62639a01928a5dab824d2eadf589e5cbfe5a2bc41d9654
-
SHA512
e3582e0969361d272c2469ce139ec809b9b0ac98fbc5eb5bb287442aed4c6ba69ed8175b68970751c93730cfaf07b75c3bc5e4e24aeda8f984b24f33bb8e3da2
-
SSDEEP
768:Q/WQ3/TymxfsHYPry0bgYh3LKgMoCDGFh9D:Q+QvT7xUHYPDbgYVLWofD
Malware Config
Extracted
plugx
103.56.53.46:80
103.56.53.46:110
103.56.53.46:443
103.56.53.46:5938
-
folder
AvastSvcZEg
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3456 AvastSvc.exe -
Loads dropped DLL 1 IoCs
pid Process 3456 AvastSvc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AvastSvcZEg = "\"C:\\ProgramData\\AvastSvcZEg\\AvastSvc.exe\" 303" AvastSvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AvastSvcZEg = "\"C:\\ProgramData\\AvastSvcZEg\\AvastSvc.exe\" 303" AvastSvc.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: AvastSvc.exe File opened (read-only) \??\F: AvastSvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastSvc.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu\CLSID = 39003500360036003200460044004100380044003200340030003300390032000000 AvastSvc.exe Key created \REGISTRY\MACHINE\Software\CLASSES\ms-pu AvastSvc.exe Key created \REGISTRY\MACHINE\Software\CLASSES\ms-pu\PROXY AvastSvc.exe Key created \REGISTRY\MACHINE\Software\CLASSES\ms-pu AvastSvc.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\ms-pu AvastSvc.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3456 AvastSvc.exe 3456 AvastSvc.exe 3456 AvastSvc.exe 3456 AvastSvc.exe 3456 AvastSvc.exe 3456 AvastSvc.exe 3456 AvastSvc.exe 3456 AvastSvc.exe 3456 AvastSvc.exe 3456 AvastSvc.exe 3456 AvastSvc.exe 3456 AvastSvc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3456 AvastSvc.exe Token: SeDebugPrivilege 3456 AvastSvc.exe Token: SeTcbPrivilege 3456 AvastSvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1972 wrote to memory of 4680 1972 cmd.exe 84 PID 1972 wrote to memory of 4680 1972 cmd.exe 84 PID 1972 wrote to memory of 4680 1972 cmd.exe 84 PID 4680 wrote to memory of 3456 4680 AvastSvc.exe 85 PID 4680 wrote to memory of 3456 4680 AvastSvc.exe 85 PID 4680 wrote to memory of 3456 4680 AvastSvc.exe 85
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\AvastSvcZEg\AvastSvc.exe1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\AvastSvcZEg\AvastSvc.exeC:\Users\Admin\AppData\Local\Temp\AvastSvcZEg\AvastSvc.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\ProgramData\AvastSvcZEg\AvastSvc.exeC:\ProgramData\AvastSvcZEg\AvastSvc.exe 3033⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD553830fe278811363f93e0906d8b5ce69
SHA1b133578af848e10500cc8b943483ed71e86a713a
SHA2568ec409c1537e3030405bc8f8353d2605d1e88f1b245554383682f3aa8b5100ec
SHA512c87497b49d2924be200053495074e16d82fdc875ecdcd231e185479901020c176c2a478c52eea55a9908fe3605ed3d5b2037fa4c83248d4d2bfea45f9f03dc37
-
Filesize
60KB
MD5a72036f635cecf0dcb1e9c6f49a8fa5b
SHA1049813b955db1dd90952657ae2bd34250153563e
SHA25685ca20eeec3400c68a62639a01928a5dab824d2eadf589e5cbfe5a2bc41d9654
SHA512e3582e0969361d272c2469ce139ec809b9b0ac98fbc5eb5bb287442aed4c6ba69ed8175b68970751c93730cfaf07b75c3bc5e4e24aeda8f984b24f33bb8e3da2
-
Filesize
52KB
MD5831252e7fa9bd6fa174715647ebce516
SHA1bf8c5bf141f0db53000805f2629e6e031d137ceb
SHA2566491c646397025bf02709f1bd3025f1622abdc89b550ac38ce6fac938353b954
SHA5120be6e898dcb75b32358bb8c2214e7b9453034ecfbe71d092df75b186a28f97ae7d5737f010b9d9e781c6b4cf3da19ee4a7cf5002604d23c527c55a3f7a0dba04