Analysis
- max time kernel
141s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2023, 17:42
Behavioral task
behavioral1
Sample
PCHunter64_pps.exe
Resource
win7-20230220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
PCHunter64_pps.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target PCHunter64_pps.exe
- Size 8.3MB
- Sample230609-v9zdnscg87
- SHA256 1e2e566871e5e2d6b37ed00747f8ecd4c7098d39a2fdc8f272b1ff2962122733
- MD5 8cafdbb0a919a1de8e0e9e38f8aa19bd
- SHA1 63910a00e3e63427ec72e20fb0eb404cc1ff7e9c
- SHA512 cd65da486929240c041a7c0316a23402fc0364d778056eeeb1a07cba9b0687e6604c4f46c6f0655c6e8b8992be633aac6741bc1b841e1058e1b46fca5f0bce22
- SSDEEP 196608:FUNLE4AVXqNsw+tPWl6CGdPCGuQgWNDdEDT9iD0Y:iiDBLPWl6oqTND0Y
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ PCHunter64_pps.exe - Sets service image path in registry 2 TTPs 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCHunter64_ppsas\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\PCHunter64_ppsas.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xfgeazrqyalpwec\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\xfgeazrqyalpwec.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\pywiilcxwimjyaqus\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\pywiilcxwimjyaqus.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\physynnezzagilt\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\physynnezzagilt.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zmwqfmbexoglfh\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\zmwqfmbexoglfh.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ungrsilryqqzqfhc\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\ungrsilryqqzqfhc.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rctookielpsnnvcm\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\rctookielpsnnvcm.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wkeprhrqweowmat\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\wkeprhrqweowmat.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCHunter64_pps\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\PCHunter64_pps.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mwlpugskmzccguw\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\mwlpugskmzccguw.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avrsvotljflipsq\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\avrsvotljflipsq.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gpbgrbkykrzmgpfn\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\gpbgrbkykrzmgpfn.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\frolkdgsypvbkegwv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\frolkdgsypvbkegwv.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\oajnafzrknbzup\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\oajnafzrknbzup.sys" PCHunter64_pps.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\tgrmvipejerkkjp\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\tgrmvipejerkkjp.sys" PCHunter64_pps.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PCHunter64_pps.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PCHunter64_pps.exe -
resource yara_rule behavioral2/memory/4588-133-0x0000000140000000-0x0000000141242000-memory.dmp themida behavioral2/memory/4588-134-0x0000000140000000-0x0000000141242000-memory.dmp themida behavioral2/memory/4588-135-0x0000000140000000-0x0000000141242000-memory.dmp themida behavioral2/memory/4588-136-0x0000000140000000-0x0000000141242000-memory.dmp themida behavioral2/memory/4588-137-0x0000000140000000-0x0000000141242000-memory.dmp themida behavioral2/memory/4588-138-0x0000000140000000-0x0000000141242000-memory.dmp themida behavioral2/memory/4588-235-0x0000000140000000-0x0000000141242000-memory.dmp themida behavioral2/memory/4588-236-0x0000000140000000-0x0000000141242000-memory.dmp themida behavioral2/memory/4588-243-0x0000000140000000-0x0000000141242000-memory.dmp themida behavioral2/memory/4588-252-0x0000000140000000-0x0000000141242000-memory.dmp themida behavioral2/memory/4588-253-0x0000000140000000-0x0000000141242000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PCHunter64_pps.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4588 PCHunter64_pps.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4588 PCHunter64_pps.exe - Suspicious behavior: LoadsDriver 32 IoCs
pid Process 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe Token: SeLoadDriverPrivilege 4588 PCHunter64_pps.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4588 PCHunter64_pps.exe 4588 PCHunter64_pps.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PCHunter64_pps.exe"C:\Users\Admin\AppData\Local\Temp\PCHunter64_pps.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4588
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\xfgeazrqyalpwec.sys
- Size 624KB
- SHA256 32726fa33be861472d0b26286073b49500e3fd3bd1395f63bc114746a9195efb
- MD5 5eb2f44651d3e4b90664bab3070409ff
- SHA1 6d71d69243bc2495a107ca45d5989a6fc1545570
- SHA512 55eef39a6845567c8bf64d04e5414537837ae7937229849f7bb1f28e4ddc22428aa1d56af177606c1ea31dd8799ff96d1dfa0f80cb266afe31ca1b43fe9313b5
- SSDEEP 6144:Wy09BXuHDcDxIEQd/isJUGnRH6TW9+DLkS1nwjEggpBSebWvXi/fsGeU9M61P:Wy0fuDES3asiGkgYggpBSebokfszm
- MD5 SHA1 SHA512 SSDEEP