Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe
Resource
win10v2004-20241007-en
General
-
Target
NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe
-
Size
444KB
-
MD5
4b80ce9b09f66de598cd62ed65023a67
-
SHA1
6806afeb86cbe5d35e1738743d4946a7cecbd1b2
-
SHA256
2f76c5b27fc74986634ca1c3835f056d7e08b9d17f81f5277c20db4c86b7f2c5
-
SHA512
f96e5a2f7f3131ba26a260b789be24b6c5c720c5fda234f457763427edb5d51307b968aedccb7609b2db79d8be20117dd3941d7186c62541c7721bb928146843
-
SSDEEP
12288:NF2itC7rxZjmoXuaiHi/Xy3I3sBmy1CLoMavQ9oZ:zHSZqoXuWPzloMaI9oZ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe = "0" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2504 powershell.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "\"cmd.exe\",\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe\"" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe = "0" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Qwe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1144 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2504 powershell.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Token: SeRestorePrivilege 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Token: SeDebugPrivilege 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Token: SeDebugPrivilege 2504 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2400 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 30 PID 2536 wrote to memory of 2400 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 30 PID 2536 wrote to memory of 2400 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 30 PID 2536 wrote to memory of 2400 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 30 PID 2536 wrote to memory of 2504 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 31 PID 2536 wrote to memory of 2504 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 31 PID 2536 wrote to memory of 2504 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 31 PID 2536 wrote to memory of 2504 2536 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 31 PID 2400 wrote to memory of 1144 2400 cmd.exe 34 PID 2400 wrote to memory of 1144 2400 cmd.exe 34 PID 2400 wrote to memory of 1144 2400 cmd.exe 34 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe"C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe"1⤵
- UAC bypass
- Windows security bypass
- Event Triggered Execution: Image File Execution Options Injection
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2536 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /tn "GoogleUpdateTaskMachineUK" /sc MINUTE /mo 1 /tr "C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" /rl HIGHEST /f2⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\system32\schtasks.exeschtasks /create /tn "GoogleUpdateTaskMachineUK" /sc MINUTE /mo 1 /tr "C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1144
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe"C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" explorer.exe1⤵
- System Location Discovery: System Language Discovery
PID:1900
-
C:\Windows\system32\taskeng.exetaskeng.exe {4F2D7043-D016-42C4-A8DF-E7D34B19D472} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]1⤵PID:2768
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5