Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe
Resource
win10v2004-20241007-en
General
-
Target
fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe
-
Size
247KB
-
MD5
ab4f5253bfc80bac760c4a7d8849f524
-
SHA1
c871229e32b12bc731e2b86e638c7e03f759ee11
-
SHA256
fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9
-
SHA512
49ed70bc202f69865d223f66282dd73a370b759370b8830b4814322f10fac38baa0d34dff64a77b3fb1b7de68b77c4502df1f35244e954b8008fe067cee8daf0
-
SSDEEP
3072:82RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCozOhhBn+TF:80KgGwHqwOOELha+sm2D2+UhnguyRr
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
pid Process 2836 avast_free_antivirus_setup_online_x64.exe 1216 Process not Found 2988 instup.exe 2204 instup.exe -
Loads dropped DLL 33 IoCs
pid Process 2488 fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe 2488 fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe 2836 avast_free_antivirus_setup_online_x64.exe 2836 avast_free_antivirus_setup_online_x64.exe 2836 avast_free_antivirus_setup_online_x64.exe 2836 avast_free_antivirus_setup_online_x64.exe 2836 avast_free_antivirus_setup_online_x64.exe 2836 avast_free_antivirus_setup_online_x64.exe 2836 avast_free_antivirus_setup_online_x64.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2988 instup.exe 2204 instup.exe 2204 instup.exe 2204 instup.exe 2204 instup.exe 2204 instup.exe 2204 instup.exe -
Checks for any installed AV software in registry 1 TTPs 54 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry instup.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast instup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LicenseFile instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ShepherdDebug instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Volatile instup.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog = "C:\\ProgramData\\Avast Software\\Persistent Data\\Avast\\Logs\\Setup.log" instup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast instup.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus instup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ChestFolder instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog = "C:\\ProgramData\\Avast Software\\Persistent Data\\Avast\\Logs\\Setup.log" instup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings instup.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast avast_free_antivirus_setup_online_x64.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder instup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\burger_client instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LogFolder instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LicenseFile instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast instup.exe Key opened \Registry\MACHINE\SOFTWARE\Avast Software\Avast avast_free_antivirus_setup_online_x64.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MovedFolder instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\FwDataFolder instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Volatile\InstupUpdatePending = "1" instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CertificateFile instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Instup_IgnoredDownloadTypes instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions instup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast avast_free_antivirus_setup_online_x64.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CertificateFile instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MovedFolder instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\FwDataFolder instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Instup_IgnoredDownloadTypes instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ShepherdDebug instup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\burger_client instup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ChestFolder instup.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LogFolder instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry = "1" instup.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast instup.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 avast_free_antivirus_setup_online_x64.exe File opened for modification \??\PhysicalDrive0 instup.exe File opened for modification \??\PhysicalDrive0 instup.exe File opened for modification \??\PhysicalDrive0 fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe -
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral1/files/0x00050000000193c1-53.dat embeds_openssl -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe -
Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision avast_free_antivirus_setup_online_x64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel instup.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 instup.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 avast_free_antivirus_setup_online_x64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel avast_free_antivirus_setup_online_x64.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature instup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature avast_free_antivirus_setup_online_x64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature instup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz instup.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "42" avast_free_antivirus_setup_online_x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "71" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "87" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: instup.exe" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "64" instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage avast_free_antivirus_setup_online_x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "22" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "66" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "90" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswOfferTool.exe" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "37" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "12" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "61" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "13" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "19" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "37" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "92" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: setgui_x64_ais-997.vpx" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "69" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "100" avast_free_antivirus_setup_online_x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "2" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "35" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "42" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "58" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "83" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Updating package: avdump_x86_ais" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "7" avast_free_antivirus_setup_online_x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "0" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "6" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "67" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "69" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "77" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "79" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: sbr_x64_ais-997.vpx" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Main = "0" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "40" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "100" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "56" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: instcont_x64_ais-997.vpx" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: instup.dll" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "88" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "92" avast_free_antivirus_setup_online_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "DNS resolving" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Main = "37" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "17" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "24" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "49" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "75" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Main = "75" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "1" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "15" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "38" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Updating package: avdump_x64_ais" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Main = "12" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Updating package: offertool_x64_ais" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "33" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "70" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Updating package: instcont_x64_ais" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "61" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "36" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "56" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "65" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "91" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: avdump_x64_ais-997.vpx" instup.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2836 avast_free_antivirus_setup_online_x64.exe 2836 avast_free_antivirus_setup_online_x64.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 32 2836 avast_free_antivirus_setup_online_x64.exe Token: SeDebugPrivilege 2836 avast_free_antivirus_setup_online_x64.exe Token: SeDebugPrivilege 2988 instup.exe Token: 32 2988 instup.exe Token: SeDebugPrivilege 2204 instup.exe Token: 32 2204 instup.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2988 instup.exe 2204 instup.exe 2204 instup.exe 2204 instup.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2836 2488 fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe 31 PID 2488 wrote to memory of 2836 2488 fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe 31 PID 2488 wrote to memory of 2836 2488 fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe 31 PID 2488 wrote to memory of 2836 2488 fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe 31 PID 2836 wrote to memory of 2988 2836 avast_free_antivirus_setup_online_x64.exe 32 PID 2836 wrote to memory of 2988 2836 avast_free_antivirus_setup_online_x64.exe 32 PID 2836 wrote to memory of 2988 2836 avast_free_antivirus_setup_online_x64.exe 32 PID 2988 wrote to memory of 2204 2988 instup.exe 33 PID 2988 wrote to memory of 2204 2988 instup.exe 33 PID 2988 wrote to memory of 2204 2988 instup.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe"C:\Users\Admin\AppData\Local\Temp\fc82dae07a2ed2e600e072d5266804693a0048d6434fdae832264f021a0d97e9.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\Temp\asw.947a914b7bbda803\avast_free_antivirus_setup_online_x64.exe"C:\Windows\Temp\asw.947a914b7bbda803\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_003_999_a8a_m:dlid_FAV-ONLINE-HP /ga_clientid:0ff4f4f2-7b05-4917-98a5-9e9c6c7c6e88 /edat_dir:C:\Windows\Temp\asw.947a914b7bbda8032⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\Temp\asw.ba451afd182341c1\instup.exe"C:\Windows\Temp\asw.ba451afd182341c1\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.ba451afd182341c1 /edition:1 /prod:ais /stub_context:f67aa2df-5dd1-4923-bf7c-f527fa061305:11072232 /guid:d9f2760b-2fb8-4116-8772-54ea5c032ded /ga_clientid:0ff4f4f2-7b05-4917-98a5-9e9c6c7c6e88 /no_delayed_installation /cookie:mmm_ava_003_999_a8a_m:dlid_FAV-ONLINE-HP /ga_clientid:0ff4f4f2-7b05-4917-98a5-9e9c6c7c6e88 /edat_dir:C:\Windows\Temp\asw.947a914b7bbda8033⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\Temp\asw.ba451afd182341c1\New_15020997\instup.exe"C:\Windows\Temp\asw.ba451afd182341c1\New_15020997\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.ba451afd182341c1 /edition:1 /prod:ais /stub_context:f67aa2df-5dd1-4923-bf7c-f527fa061305:11072232 /guid:d9f2760b-2fb8-4116-8772-54ea5c032ded /ga_clientid:0ff4f4f2-7b05-4917-98a5-9e9c6c7c6e88 /no_delayed_installation /cookie:mmm_ava_003_999_a8a_m:dlid_FAV-ONLINE-HP /edat_dir:C:\Windows\Temp\asw.947a914b7bbda803 /online_installer4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2204
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD53dfb609138cead70aa9b33bf1a259e54
SHA1ce561d6a3f1dbcaccdc168242d5e376a4a22e59d
SHA2568d80dff9ab037d7e6e096f924ae6fe3941b66e2bea6e324f68621f6ec0940bc0
SHA51210766e3d8ecfc138250c32093723c1ed3522036b9fa0f326ca5be32aaa5fda758352d575fa1346de1fd42b505123a906914478ed73cd8944a98474d48db67d5f
-
Filesize
6KB
MD58d1d4b346943c4b3dc93c8f3921e7ec6
SHA140dfae6876d0913fb9aa657b1e5746dbeb0d4a5e
SHA2565adc5eef01fa3c7f7e8603e548ba1129b6096c7731e5f4dd9798f0d662222cc6
SHA512890a9d238f07595f2ea87034569bb12e598db1d217fa41d4e94d1f9c931404281d611ad5a304774d61b3d7bd15fec4430e82689dac4b5f1a5386f62bd29f9d7e
-
Filesize
142B
MD5e65763c4b4aa6a9f1817249b83b32f89
SHA1f47a625bf34d71f4755e0797795aa63190803570
SHA256d97ed7b4783a81392af34451b026b246395f37a31ffd35f02b73c0387a77e7dd
SHA51274389b6147cc7cdb484df5523fbf33e88969656aec122ef2b36bd5b36fae20b849574f1a572a9a45eb08812cd8be228403849e92c92f35a00f129f9c75c773c9
-
Filesize
40B
MD5e474dbcce611441cc45940ccb6463340
SHA161b5a8a78cfe610683d9c96c3065fd8acf60b63e
SHA256dacde89602498617c0096e9809c514234e1aa9f9c7ba6dad8adb1125ddf70696
SHA5120b4ddaf015708ff3e66781856cda92bd0d0f2d0288211a8463fad9aa1af1ec4d54e2f1832e6428bfddd93b71e3a77fb2ea0484c16faf0baa98bd09776fe9406c
-
Filesize
21.7MB
MD50d09efc988c41b14c4fd0bd9c1457b87
SHA17c8bb0b4760edfc009e8b122124aa2b70e1da93a
SHA25649ae4e9a468593038c1ab7fd6f988ddc0eace7e8c3c407c53b130e2eba1506fb
SHA512b54c3ab104ce574690155d672146be30a1ae45abec71ddaad81ba16f9435f76deb4daccab628b006cbde0e9c9a85b99a3b8a33ad4dd3ebdc05a2dbb963062993
-
Filesize
3.7MB
MD56179a6bcb9d35753d2deb3c1594a9bad
SHA1d114563b01f474084efd2c4f7edef133cdc1018f
SHA2560f1d9af4f5eee63bf1959ec61e459f9f304c77ba3af29cbd640910661ecbe2d2
SHA5122cd159f3de29a011d4b6c807e87c3b404e311f39d015b5760febab1f480cca9bb8472ec53e912d526eaba65f58659acea1530923caa6c2baa60cfd9f98786f69
-
Filesize
19.1MB
MD59ee6528abdad768fbfa28bd1bb80ebe9
SHA1f5582697e068ba1d56825fc32bd5ab1a71bd4d38
SHA25661a7bff3d789aa29add514052a0ff1703079ce427705ead5ce7dd98a0df9ecd4
SHA512de22b846a13390eda5940c7f7de7ed63af22b16b4add149363d3f3d1c4cad4c2bb99b6ecb9fcab08dc018d36fe4d8b457a5e7edba7a34e62e915ff6f2ecabfc9
-
Filesize
831KB
MD5c5665f1f93d9aabbcb1dde533e2c46e6
SHA1732389de20c600d0222d61b4ee74b0be6412a45b
SHA256adf4276ef7f276d2178b85790a178c4e903d9776c0eb18dfe4c89a481694dc8a
SHA51251a148db86a97fc13aa8db21540f8200dc2e9e325c7d2014cf55074d3ad6ce25d25a798551e3f0bb1e546a9f9536db512cbc9b14b51680d87848747a1fc465a0
-
Filesize
3.1MB
MD5b216fc28400c184a5108c0228fba86bc
SHA15d82203153963ebede19585b0054de8221c60509
SHA2567827bda61139b0758c125de5f31e38025ed650be86bb8997dce8c013ec89e5bd
SHA5126af7877e46e820dcc5fe67ce94393575d0d4b39d0421679b34bc25e8a62254a3dbce29f9de69d2fa4506235748dd919a91c875c90ef950c9d3a6939bff7b3294
-
Filesize
4.5MB
MD5ef035189604e7f5d68a62827b985ccbb
SHA1c094c6eef2640a71aee9f4b27123c2080d38136f
SHA25664fd38d5697a9119cebc8fd5710a452645a09d076a4b2863a4383f94d3496740
SHA51232f2af9929598b5eaee6de3a95f755da27622c3a791e43dfde41c470dfb278b843e67327e0d0d2f7b49b61b94dc8e4a1e9eadd3a91664ff339d03448d0c881c9
-
Filesize
907KB
MD5700b6740e6bfa7729f146572d8455348
SHA119d80fb0251f417283ed36fc20c43079b3f6fbb8
SHA256d3c0ba08fda4ed42c1389f6e34061b030b2b1017395308aac1d5b25eb3ad1f0e
SHA5127786b63b8fc9c10030b5bca591378b13d05aeeac36072f52ddf24ce46cb12cfab88d9358000b15afdef0c59dbbe5fa22411b354fd0e24f3b1a3098eab3d79b65
-
Filesize
32KB
MD55a0f70dfbf66819ca9c50d6ac6f3702a
SHA1ab4d2eac9985dba69422cf8cd6bc36846eda1855
SHA25631acc29e2df1d0841bbe81db1c28e145d44aa5805c3fd3a1615b6768a08514c2
SHA51213b24f45680e1607dc6fd2560b697918d11c4d8fec1ef561961e5846887f37623470782e36daa16005bf52142de3bd2ff15860c015a798e4729d6625c335c0ad
-
Filesize
33KB
MD54e0a8d764db17882ef26c361986242b4
SHA18c36de33f66a517be62da29b5ba5c961bc26b17e
SHA2561aae74525859be84c73d1cb2376a4fe0cbe01207681214575ee26d292bf72d31
SHA512d7c2110e332352443867d4d10487f9600ff66ca5d1d4f12744b961895f750cfca5e9a2ff62fb2d70ce3357a28c782ca7e4cdbc6b44be1f9d7b6730b6234ff8f7
-
Filesize
38KB
MD5238de9a5034e9845d47e4e7c098a98d9
SHA17b62a8ad7e4a2c76b3120809723fb879c17ff60d
SHA256467ce34255442268f17c0f9009164f4be3bbcf6bea95b106eba82c53420d3928
SHA512b90af6f6bb06144cf3e8b39ff3ee7c6696a779217512efe1d41b03601ce0fef5cd9b2fc51bbeca88f3b536effa7364c2a6624dee75f1d62f4e502ba17ea810d7
-
Filesize
906B
MD57a3f3d65e4930d6a6ecdbb368786579a
SHA1d58a9d1aac75065d9aca93222f131563b1651954
SHA256b152ebdac0afe2adfe51b876ebe0a3d806a787602532bbd609b8111da8830552
SHA512a07cc3d2d282276ac9cbfc8ceea6f5466ba7ca0b06a12728f61f7ebb3efc808330761047f13da1277a1b0ab0c38b02287ef4c3c9789d6fe4143fd7b54f063ebf
-
Filesize
700B
MD50487afba722c75421dab5ad76c907b64
SHA12af01aae124736188c6879265bc8e5b8aaf5f633
SHA256756380ea118c2bc721918c7fe94300032667b3f5a143b6374246e80339833019
SHA51223047f15ca793efd76614034455653960540b7831b726234501f8bb3d057ac48ce7fef0370cb4adbffe1f1c37d4199176a701479c8824afbe3ae55ca5714ac1d
-
Filesize
188KB
MD5b898fa20bf9b0321b50a8d4946aae799
SHA14e173a99dc9a9ef507112857525ad53991f4d2a0
SHA2566a2b3de2d13269bc9b3d68b7fbffd9edcfa94dea83ffd3d5f7a03f05bda09a6c
SHA512c34e5b9f04c2322ec0ce24f582be148554ebff9aee8b312ba272b94b54f077370d345ec24d284ea66db67bd7104b343fa9c2646100d64d3b6361ab7ffe7e2810
-
Filesize
5KB
MD5365b6ee6fbde00af486fc012251db2da
SHA18050ba5a9b6321f067fc694527011ba00767d4a2
SHA25601fbb98a20ed29cd83e42351aa1fc361d4513b9ade8d71f62383bc76d5f86830
SHA512949b877dc558a9215369fddce4bbeb3c0fbec09c1b92717a8d027001337743e300a1089ff46f3b49a33f4d6b4e7bb5a2d4cb6ea96c9114e308833c7e15d8b261
-
Filesize
11KB
MD5fbaf91e11247fcacda8bbba7e78e5aae
SHA188d882c06b0f3c30d69fe1aa018d921f1264a8bc
SHA256d5b2609e3056fb970c1ff0dd020add9fb95208c520058308595ea9a550f40317
SHA512b5e647dfe1bfa9a81235ab91719548ac473b32f31a0c0515bf79191c23e35bc48d1654c31258df35150e27357f5e9f615b4c63450e77d081396a6c7425aaa99b
-
Filesize
573B
MD5db09685c045dc0df0552427c752a1aa7
SHA1eb0e8e1e9839e7517efb7fedfa7edabc5d57587a
SHA2569219680462bef7060264ac63d21f3332daf0fca5090cae295427710895be0002
SHA512d0b4b1c23557aa18a5ca9299c7269cd2221ec8b155b9ec9c045f6ddb612f1979a9d3e78ae395dc6e515338ee8bdf13225a1cafc903bc800a22b9b9e3489a462b
-
Filesize
342B
MD58499e8596ec1c873e132662092da0a85
SHA1dd27c53c9fb86cbcc367182fccf8bd0af6ebb763
SHA25626d22504cae4bb0e7de6e10317a97aa4be15a0a3fa9bf2d735d89213696e0712
SHA512f06bcf0f8239a15c78b8113d27c60b32bcdc1be25d913ef3356ca5a58349e12b14b6673838e83972d81e90e338d948781626d5ff6db3a6fea303b8aead98824d
-
Filesize
342B
MD5fa7efdecc2537c953bb8a49f6ac54224
SHA168821ae21e5c476b5f451bd5a0a6fb6650a421f1
SHA25616ee2337d70bd3241362fd815d6ccf948836e3c5bfa1eb7921592ac909c0cba9
SHA5123f4e9d2e016b3d47fa2492dd0c7788bd2d320fcc39dca850ffa94d1ceaf212573f76c3e8305817ee282811f7533284a1619987ceaaee6858c8702d5cf412f538
-
Filesize
15KB
MD513e9fbb02cb7497562b59a9ef8f1ee92
SHA1047936e9296e77939b5b23c1a2af3056eaa2ae99
SHA25640fdd6306bbd29d680af6e6931751b3a9a133d7786d9409a47b6f115b968565a
SHA5120d5c6d3f2465fd9d1af19c1a02c4f4a3bedb02f0e049e97166ed100964ff1ff1be28ed02542a90c4ad3e1041bb3f3cf8b65d561c6ebc41fce1f935f277d606ba
-
Filesize
29KB
MD5b1960612149e68ce8d6f4827c5b39073
SHA16259a3ebd659bb63ec59fab4c8e1aa79092692a4
SHA256847bd020bc930856d25c54d5fa03278b0e6b2434f2560f3c6b7c000332012173
SHA51281d2737ca459d8fb3aab6dede1c666efdb6c3a851f1018a8b2d5166060de05fff7abb8eaa9e24ee441137033bd0574ce107ef9d3abd93ddde4b86cda76625423
-
Filesize
2KB
MD5eab5eaa228b24e2a0c3313fc200caa97
SHA1407dd379fd78df5b31585931fc567a1f9a3da40c
SHA2565d784971dcc44fd271dccb4351ebabb16b3170ff680ccfa64dc848a4125651fa
SHA512126b2bf2a5fe7a4d78eb766f95e4e7fc15095876ffc25f0955f1d073f351281b3d7a8f1cc3c8b8cfad7157e705a0d8019b28a82ce72c15f02cd31029b801bb0a
-
Filesize
37KB
MD5be793535c4acf02d4ad13b20d0c84deb
SHA165dd6b4891a75848042c10057808535298cee3e1
SHA25631f9f4cfff1900e8a4ece24ddb5da2736409779b970e29e4bf9fe00b985c65cd
SHA5127f6c482103757d353b6cc50ccd6c618454f653d3e7eeef743e0bc74cae71c72f56ee0f1213deeeb4ad6e1cce244d7d017044e928c80a507de343cacd89238f62
-
Filesize
16KB
MD563e7a59b7d1f9405ba1a0e685ca98af7
SHA1c90d503b31b8027a0fbbe1f0008021e27ce42609
SHA25603cee410775634e7570b80077ca95e47cbafbdf982c19ac2e222726d28b9a584
SHA5129b70322f966accc16435bd3869106be18ac7e21962846938e64c7001c663cbd1ea7a7662e0d85af97af05820192ceb0bb01d65cff3d7bbe8467b873a872d644f
-
Filesize
10.6MB
MD5285b70b3ac1698009e386ece00acee56
SHA1dda4d5748970490ca1100d7e076045b3648008a3
SHA256df8b438844b84bae4a78bd4a593fd28be2fd58a0fd431e4b942661eea9476dc0
SHA5125c4a1819cd444d576e81fa10a686dabce9e66fae197aa1668cc2d394289a2722eeed7f88f5d3b80b2c9526ede50cb03deba999ecbaeb30e212c91e84b540580f
-
Filesize
4.0MB
MD5b0e91293160024bfc0302bbdadd0bb9c
SHA1005fbe3c47213d4b791c05f2a8a6932dc70357e9
SHA2563db7c1fc402a689bb160ed2d0bc12edb6765307c725ad02e7b27510008b4f8ca
SHA512f7239b26fedc2a90c2b267467781ff26512890b879772bcc0809409a368fefd74a8930d8d4958559381dd57f7bdc769668c5ec638b5ad82e4a20a1e0217e9304
-
Filesize
3.8MB
MD5d9be57d4e1a25264b8317278f8b93396
SHA1d3c98696582fed570f38ae45bf22b8197253b325
SHA256a90e4ffa0fcd535733b6306d701cbb975245b8253df54b277970d8b8c1cf09c3
SHA5122f13454c7e4360326f1dc417ad24e2d095b7178d89791f5b436d134c2fe26724bc48d6de1291208800b7c93dfe7082e8300b2d545c5db3e2590603dd3f8a5697
-
Filesize
29KB
MD5b49ac1e7007e1e445c45fc906e96687e
SHA1b33adeb3d8ad516a3fe826cc3f48f9c6e67030cb
SHA256da17cf39c773ab3048e767aff993458e284837287e8c4af0d139ad71f3459ff8
SHA512e3ef8ef9423552281dc12e25eeef69b954e50bc844442d7e0de9c7e066c53e62dc84a43e44428caff1e18b06470c17d25e65825c07f5f85535d97ace23f05ba2