Overview

overview

6

Static

static

3

Не по...06.exe

windows10-ltsc_2021-x64

6

$TEMP/AnVir.exe

windows10-ltsc_2021-x64

6

anvir64.exe

windows10-ltsc_2021-x64

1

anvirlauncher.exe

windows10-ltsc_2021-x64

3

Analysis

  • max time kernel
    83s
  • max time network
    85s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    20/07/2026, 19:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    $TEMP/AnVir.exe
  • Size 11.2MB
  • Sample260720-ye7ncae16s
  • SHA256 e0cbf935b59a329b25581611ff509cbae7d023acc4e312f26d0cde43b3f1db40
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdefense_evasiondiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 17 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\AnVir.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\AnVir.exe"
    1⤵
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4164

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        E0968A1E3A40D2582E7FD463BAEB59CD
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD
        • Size 1KB
        • SHA256 68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        E0968A1E3A40D2582E7FD463BAEB59CD
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD
        • Size 306B
        • SHA256 4b62c55f6a5dac96b7c96990b5f516ac2c5867c20d2c747c5bac6f4860433b4e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        versionsinfo.dat
        • Path C:\Users\Admin\AppData\Local\AnVir\versionsinfo.dat
        • Size 9KB
        • SHA256 3bfcb8e81a01a2481bbefc0c79112c8ea969e1a011d59a9de298927e64b55fa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        versionsinfo.dat
        • Path C:\Users\Admin\AppData\Local\AnVir\versionsinfo.dat
        • Size 9KB
        • SHA256 7e9a8e991ea1588693bdc4389e48e71b8b74a3ab5a539aca2d6f1f524eb6daaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        versionsinfo.dat
        • Path C:\Users\Admin\AppData\Local\AnVir\versionsinfo.dat
        • Size 2KB
        • SHA256 61ff98a9abf4dedd9b20d49e92ce9d4883b17058f1752a39342c925eaa23c323
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        versionsinfo.dat
        • Path C:\Users\Admin\AppData\Local\AnVir\versionsinfo.dat
        • Size 26KB
        • SHA256 1137614af2b6d566a7c76df7fcbe99b5414800028da7aa5b1e81f86d6a81a580
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        versionsinfo.dat
        • Path C:\Users\Admin\AppData\Local\AnVir\versionsinfo.dat
        • Size 33KB
        • SHA256 afa3aba426beb71df0bd379071a22cf7696dbb1c042ac77106dc29cabf5f47f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        versionsinfo.dat
        • Path C:\Users\Admin\AppData\Local\AnVir\versionsinfo.dat
        • Size 4KB
        • SHA256 72a918a9bd3bcb7c431457ba5225fe76cf0f8b684d9b92a1d9980360a2870889
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        versionsinfo.dat
        • Path C:\Users\Admin\AppData\Local\AnVir\versionsinfo.dat
        • Size 4KB
        • SHA256 e795fc943708a15ce4e3bf36e900d942cead73ecfb57f544af2c3f3a9bc0ad61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download