Analysis
-
max time kernel
311s -
max time network
340s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 09:47
Behavioral task
behavioral1
Sample
PC_Hunter64.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
PC_Hunter64.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
PC_Hunter64.exe
-
Size
6.5MB
-
MD5
0f523b43820492f75a01bc92f9f81704
-
SHA1
1c781c4e9a46f6d8614ca035cf3c7a7b08fc122d
-
SHA256
463abf705f1e359ac2ff77d6f922006bc3f68a1f82b359ef3a8cea53fe94b757
-
SHA512
2baa8402987e45c7800650cf136778c484fd8fdb19da9448fe04529d41ba450a504b163ce4a8e9f29bf19fed1ad92cc5add66420bb6b8973425f4d0bf678a69b
-
SSDEEP
196608:eiD3HjMKpxYgElDsscE54f3F4hLt0RsI7oMFsnIOIC:N3+L5a3FmniG
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 6 IoCs
Processes:
PC_Hunter64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PC_Hunter64\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\PC_Hunter64.sys" PC_Hunter64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\iqgpftmfkdkzsgdjj\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\iqgpftmfkdkzsgdjj.sys" PC_Hunter64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ulnuiczzjvvifj\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\ulnuiczzjvvifj.sys" PC_Hunter64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\qzardvwmwuywcs\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\qzardvwmwuywcs.sys" PC_Hunter64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nwnozocajuakzaj\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\nwnozocajuakzaj.sys" PC_Hunter64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PC_Hunter64as\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\PC_Hunter64as.sys" PC_Hunter64.exe -
Processes:
resource yara_rule behavioral2/memory/2644-132-0x0000000140000000-0x00000001412B3000-memory.dmp vmprotect -
Suspicious behavior: LoadsDriver 32 IoCs
Processes:
PC_Hunter64.exepid process 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
PC_Hunter64.exedescription pid process Token: SeDebugPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe Token: SeLoadDriverPrivilege 2644 PC_Hunter64.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
PC_Hunter64.exepid process 2644 PC_Hunter64.exe 2644 PC_Hunter64.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2644-132-0x0000000140000000-0x00000001412B3000-memory.dmpFilesize
18.7MB