> Analysis · 1290bdba07eb_

~/packetpursuit $ cat /intel/analyses/1290bdba07eb.../report.md

confidencehighcreated2026-07-03
SHA-256: 1290bdba07eb77310f187c0392c5c9469ad2ad74baec9815b033ce99c445daaa

SilverFox — AV Teardown Driver-Dropper Variant

Build / RE

Toolchain: MSVC 14.30 (Visual Studio 2022), C/C++.^[pefile.txt:49] PE32+ x64 console executable, 8 sections, ~659 KB.^[file.txt] Compile timestamp 2026-05-24 13:14:02 UTC — fresh build.^[pefile.txt:38]

Packing / obfuscation: None. No packer, no section encryption, no PEB-walking API resolution. Standard IAT with plaintext imports from KERNEL32, ADVAPI32, SHELL32, and ole32.^[pefile.txt:292-460] Entropy on .text is 6.52 — unremarkable.^[pefile.txt:95]

Anti-analysis: Absent. No debugger checks, no VM detection, no sandbox gates, no IsDebuggerPresent branching in main flow. The operator appears to rely on the driver payload and IFEO manipulation for evasion rather than binary-level obfuscation.

Embedded resources: 1735 GUID blocks stored in .rdata, decoded at runtime by a string-decrypt loop using multipliers 0xb529 and 0x9e37 followed by XOR.^[r2:fcn.1400095d0] These GUIDs likely represent driver service names or hardware IDs used during driver registration.

Driver payload extraction: Function fcn.140005090 decodes the GUID blocks, then decrypts a bundled driver image using RC4 keyed with LordROmAn$ followed by an additional XOR pass.^[strings.txt:453]^[r2:fcn.140005090] Decrypted image is dropped to a constructed path (Ensuring drop directory exists string), then loaded via NtLoadDriver.^[strings.txt:10302]^[r2:fcn.140005090]

String decryption: A helper routine at fcn.140004580 decrypts wide-character strings in-place using the same 0xb529 / 0x9e37 multiplier XOR pattern. Target names decrypted at runtime include:

  • MpDefenderCoreService.exe^[r2:fcn.1400095d0]
  • SecurityHealthService.exe^[r2:fcn.1400095d0]
  • SecurityHealthSystray.exe^[r2:fcn.1400095d0]

Key routines:

  • main (0x1400073a0): Resolves NtLoadDriver, NtUnloadDriver, and RtlInitUnicodeString from ntdll.dll via GetModuleHandleW/GetProcAddress, stores function pointers to globals, then dispatches to teardown and driver routines.^[r2:main]
  • fcn.1400095d0: Decrypts target AV component names and prepares the IFEO teardown target list.
  • fcn.1400015e0: Enables SeBackupPrivilege and SeRestorePrivilege required for offline hive manipulation.^[strings.txt:10255]^[r2:fcn.1400015e0]
  • fcn.140006a60: UAC bypass / elevation — constructs a SHELLEXECUTEINFOW with the runas verb and spawns a high-integrity child.^[r2:fcn.140006a60]
  • fcn.140005090: Full driver dropper pipeline — GUID decode → RC4+XOR decrypt → drop → NtLoadDriver.

Deploy / ATT&CK

Static-only inference. CAPE skipped — no Windows guest available.^[dynamic-analysis.md:3]

Technique ID Evidence
Abuse Elevation Control Mechanism T1548.002 runas verb via ShellExecuteExW in fcn.140006a60 to spawn elevated child.^[r2:fcn.140006a60]
Impair Defenses: Disable or Modify Tools T1562.001 IFEO hive manipulation — sets Debugger → systray.exe for Windows Defender and Security Health executables, preventing their launch.^[strings.txt:10258]
Image File Execution Options T1546.012 Saves IFEO hive offline, modifies Debugger values, then restores hive via RegRestoreKeyW.^[strings.txt:10258]^[strings.txt:10262-10265]
Exploitation for Privilege Escalation T1068 Loads a kernel driver with NtLoadDriver after enabling SeLoadDriverPrivilege.^[strings.txt:10289-10291]^[strings.txt:10296]
Create or Modify System Process: Windows Service T1543.003 ChangeServiceConfigW / ChangeServiceConfig2W plus registry writes setting Start=4 to permanently disable AV services.^[strings.txt:10276]^[pefile.txt:421-422]
Boot or Logon Autostart Execution: Registry Run Keys T1547.001 Appends payload path to Userinit registry value for persistence.^[strings.txt:10354]
Hide Artifacts T1564.003 Drops driver image to a constructed directory, loads it, then unloads and deletes the file.^[strings.txt:10347-10348]
Valid Accounts T1078 ImpersonateLoggedOnUser imported for token impersonation.^[pefile.txt:425]
Native API T1106 Resolves and calls NtLoadDriver, NtUnloadDriver, RtlInitUnicodeString dynamically from ntdll.dll.^[strings.txt:10289-10293]^[r2:main]
Service Stop T1489 ControlService imported to stop running services before disabling them.^[pefile.txt:423]
Process Injection T1055 OpenProcess, VirtualProtect imported; likely used to manipulate target processes during teardown.^[pefile.txt:323]^[pefile.txt:383]
Registry Run Keys T1547.001 RegCreateKeyExW, RegSetValueExW used to write Userinit payload path.^[pefile.txt:422]^[pefile.txt:426]

C2 / network: No network artifacts observed in strings or imports. This variant is a pure local AV teardown and driver-dropper stage; C2 is likely handled by the launched protocol.exe payload (not present in this binary).

Attribution: Chinese-language SilverFox cluster. The LordROmAn$ RC4 key is a new artifact not observed in prior variants (Rust dropper, C stub, RC4 loader, Authenticode IAT, DLL side-loader, .NET Native AOT). Build toolchain (MSVC 14.30) is also newer than every prior variant (MSVC 14.0–14.16). This represents a sixth distinct build pipeline within the family.