Analysis
-
max time kernel
134s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2022, 05:51
Behavioral task
behavioral1
Sample
652cd7f902bb425412ae012d185404de.exe
Resource
win7-20221111-en
7 signatures
150 seconds
General
-
Target
652cd7f902bb425412ae012d185404de.exe
-
Size
203KB
-
MD5
652cd7f902bb425412ae012d185404de
-
SHA1
cd4e0c85cffc30f2fbb96b9abb6f676aca158e74
-
SHA256
2e5622fd802c093a35faf9bde7d0129eb9430e4e87ab786fad4715c626f84a62
-
SHA512
6822bed7c79298123554334c5845952a3ebd04635b7ea42afebfc9d54c271edab27fcc79eb63feb6bb2345095ab582af387936a544d329793195e97e58ef5b29
-
SSDEEP
3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HInrNIVUe6XLZRrXzELuY0BWsH9:wLV6Bta6dtJmakIM5CNIL6XFRHOsH+S
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCI Manager = "C:\\Program Files (x86)\\PCI Manager\\pcimgr.exe" 652cd7f902bb425412ae012d185404de.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 652cd7f902bb425412ae012d185404de.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\PCI Manager\pcimgr.exe 652cd7f902bb425412ae012d185404de.exe File opened for modification C:\Program Files (x86)\PCI Manager\pcimgr.exe 652cd7f902bb425412ae012d185404de.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4396 652cd7f902bb425412ae012d185404de.exe 4396 652cd7f902bb425412ae012d185404de.exe 4396 652cd7f902bb425412ae012d185404de.exe 4396 652cd7f902bb425412ae012d185404de.exe 4396 652cd7f902bb425412ae012d185404de.exe 4396 652cd7f902bb425412ae012d185404de.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4396 652cd7f902bb425412ae012d185404de.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4396 652cd7f902bb425412ae012d185404de.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\652cd7f902bb425412ae012d185404de.exe"C:\Users\Admin\AppData\Local\Temp\652cd7f902bb425412ae012d185404de.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4396