Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2025, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe
Resource
win10v2004-20241007-en
General
-
Target
NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe
-
Size
444KB
-
MD5
4b80ce9b09f66de598cd62ed65023a67
-
SHA1
6806afeb86cbe5d35e1738743d4946a7cecbd1b2
-
SHA256
2f76c5b27fc74986634ca1c3835f056d7e08b9d17f81f5277c20db4c86b7f2c5
-
SHA512
f96e5a2f7f3131ba26a260b789be24b6c5c720c5fda234f457763427edb5d51307b968aedccb7609b2db79d8be20117dd3941d7186c62541c7721bb928146843
-
SSDEEP
12288:NF2itC7rxZjmoXuaiHi/Xy3I3sBmy1CLoMavQ9oZ:zHSZqoXuWPzloMaI9oZ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe = "0" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2064 powershell.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "\"cmd.exe\",\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe\"" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe = "0" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Qwe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 2064 powershell.exe 2064 powershell.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Token: SeRestorePrivilege 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Token: SeDebugPrivilege 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Token: SeDebugPrivilege 2064 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3780 wrote to memory of 2976 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 85 PID 3780 wrote to memory of 2976 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 85 PID 3780 wrote to memory of 2064 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 87 PID 3780 wrote to memory of 2064 3780 NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe 87 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe"C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe"1⤵
- UAC bypass
- Windows security bypass
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3780 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /tn "GoogleUpdateTaskMachineUK" /sc MINUTE /mo 1 /tr "C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe" /rl HIGHEST /f2⤵PID:2976
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS RUN TURN OFF ANTIVIRUS.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1484
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82