Overview
overview
6Static
static
1Norton Sui...es.zip
windows10-2004-x64
1Norton Sui...es.zip
windows11-21h2-x64
1AvBugReport.exe
windows10-2004-x64
6AvBugReport.exe
windows11-21h2-x64
6AvConsent.exe
windows10-2004-x64
AvConsent.exe
windows11-21h2-x64
AvDump.exe
windows10-2004-x64
1AvDump.exe
windows11-21h2-x64
1AvEmUpdate.exe
windows10-2004-x64
6AvEmUpdate.exe
windows11-21h2-x64
6AvLaunch.exe
windows10-2004-x64
AvLaunch.exe
windows11-21h2-x64
NortonSvc.exe
windows10-2004-x64
NortonSvc.exe
windows11-21h2-x64
NortonUI.exe
windows10-2004-x64
NortonUI.exe
windows11-21h2-x64
OobeUtil.exe
windows10-2004-x64
RegSvr.exe
windows10-2004-x64
1RegSvr.exe
windows11-21h2-x64
1SetupInf.exe
windows10-2004-x64
6SetupInf.exe
windows11-21h2-x64
6SupportTool.exe
windows10-2004-x64
SupportTool.exe
windows11-21h2-x64
VisthAux.exe
windows10-2004-x64
VisthAux.exe
windows11-21h2-x64
VpnSvc.exe
windows10-2004-x64
VpnSvc.exe
windows11-21h2-x64
afwServ.exe
windows10-2004-x64
afwServ.exe
windows11-21h2-x64
ashCmd.exe
windows10-2004-x64
ashCmd.exe
windows11-21h2-x64
ashQuick.exe
windows10-2004-x64
Analysis
- max time kernel
598s - max time network
473s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 00:23
Static task
static1
Behavioral task
behavioral1
Sample
Norton Suite Executables.zip
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
Norton Suite Executables.zip
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
AvBugReport.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
AvBugReport.exe
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
AvConsent.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
AvConsent.exe
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
AvDump.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
AvDump.exe
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
AvEmUpdate.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral10
Sample
AvEmUpdate.exe
Resource
win11-20260130-en
Behavioral task
behavioral11
Sample
AvLaunch.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral12
Sample
AvLaunch.exe
Resource
win11-20260130-en
Behavioral task
behavioral13
Sample
NortonSvc.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral14
Sample
NortonSvc.exe
Resource
win11-20260130-en
Behavioral task
behavioral15
Sample
NortonUI.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral16
Sample
NortonUI.exe
Resource
win11-20260130-en
Behavioral task
behavioral17
Sample
OobeUtil.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral18
Sample
RegSvr.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral19
Sample
RegSvr.exe
Resource
win11-20260130-en
Behavioral task
behavioral20
Sample
SetupInf.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral21
Sample
SetupInf.exe
Resource
win11-20260130-en
Behavioral task
behavioral22
Sample
SupportTool.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral23
Sample
SupportTool.exe
Resource
win11-20260130-en
Behavioral task
behavioral24
Sample
VisthAux.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral25
Sample
VisthAux.exe
Resource
win11-20260130-en
Behavioral task
behavioral26
Sample
VpnSvc.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral27
Sample
VpnSvc.exe
Resource
win11-20260130-en
Behavioral task
behavioral28
Sample
afwServ.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral29
Sample
afwServ.exe
Resource
win11-20260130-en
Behavioral task
behavioral30
Sample
ashCmd.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral31
Sample
ashCmd.exe
Resource
win11-20260130-en
Behavioral task
behavioral32
Sample
ashQuick.exe
Resource
win10v2004-20260130-en
General
- Target AvBugReport.exe
- Size 6.2MB
- Sample260420-apxdcset4p
- SHA256 2b149f11ec969ce162463fc2991a1e18be3f2059efa3ff733b91a06e586e708a
- MD5 8ba000cc7232c7b4cc707b49e75a2d3a
- SHA1 3496dcd5615ae1a171e2ee83d66d3a88b9eec874
- SHA512 bb45e13ed9a5a50e19ce4efbf30e48600e82661f3543329593483f364ba8a84e3a628c1f6f698dfa5aae7704440bcc0f1aa91e048a7380f6d2476f334e60e799
- SSDEEP 98304:OcvpcloFoJ6EtRZpnugpmgK2re6rUE13:OcaS6xRZpnugpmgK2re6rn
- TLSH T1F8666C1EBA6E00E9C1BFE1788A47950BEAB17855033597DB66E18E550F13AF09F3E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 AvBugReport.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AvBugReport.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AvBugReport.exe