Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2023 10:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
pcyyb__installer.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
pcyyb__installer.exe
-
Size
6.3MB
-
MD5
ceb0320e8ecca7765f2b645ad0c3126c
-
SHA1
2b7783eab695504684219521c0840cbca8e6bd6a
-
SHA256
258059c1d7ca6e90820d7b869d2368d4963bde7b3d95c39f0aad14cbb85c1868
-
SHA512
2439271346d399a24e04ca9cd320c9c56c880f32ae455be79045f216d90fbaca9b503088c78ba6d8d6316d69058c49cbc49cc909b59dc906acf7057395a5354e
-
SSDEEP
98304:GqpNBOLTydkla9/NXXiJJ+uCJDI7BclWSV7SxyqxrF:GqPBO6klaJNCJJGJsBeaF
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: pcyyb__installer.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 pcyyb__installer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 208 pcyyb__installer.exe 208 pcyyb__installer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4512 wmic.exe Token: SeSecurityPrivilege 4512 wmic.exe Token: SeTakeOwnershipPrivilege 4512 wmic.exe Token: SeLoadDriverPrivilege 4512 wmic.exe Token: SeSystemProfilePrivilege 4512 wmic.exe Token: SeSystemtimePrivilege 4512 wmic.exe Token: SeProfSingleProcessPrivilege 4512 wmic.exe Token: SeIncBasePriorityPrivilege 4512 wmic.exe Token: SeCreatePagefilePrivilege 4512 wmic.exe Token: SeBackupPrivilege 4512 wmic.exe Token: SeRestorePrivilege 4512 wmic.exe Token: SeShutdownPrivilege 4512 wmic.exe Token: SeDebugPrivilege 4512 wmic.exe Token: SeSystemEnvironmentPrivilege 4512 wmic.exe Token: SeRemoteShutdownPrivilege 4512 wmic.exe Token: SeUndockPrivilege 4512 wmic.exe Token: SeManageVolumePrivilege 4512 wmic.exe Token: 33 4512 wmic.exe Token: 34 4512 wmic.exe Token: 35 4512 wmic.exe Token: 36 4512 wmic.exe Token: SeIncreaseQuotaPrivilege 4512 wmic.exe Token: SeSecurityPrivilege 4512 wmic.exe Token: SeTakeOwnershipPrivilege 4512 wmic.exe Token: SeLoadDriverPrivilege 4512 wmic.exe Token: SeSystemProfilePrivilege 4512 wmic.exe Token: SeSystemtimePrivilege 4512 wmic.exe Token: SeProfSingleProcessPrivilege 4512 wmic.exe Token: SeIncBasePriorityPrivilege 4512 wmic.exe Token: SeCreatePagefilePrivilege 4512 wmic.exe Token: SeBackupPrivilege 4512 wmic.exe Token: SeRestorePrivilege 4512 wmic.exe Token: SeShutdownPrivilege 4512 wmic.exe Token: SeDebugPrivilege 4512 wmic.exe Token: SeSystemEnvironmentPrivilege 4512 wmic.exe Token: SeRemoteShutdownPrivilege 4512 wmic.exe Token: SeUndockPrivilege 4512 wmic.exe Token: SeManageVolumePrivilege 4512 wmic.exe Token: 33 4512 wmic.exe Token: 34 4512 wmic.exe Token: 35 4512 wmic.exe Token: 36 4512 wmic.exe Token: SeIncreaseQuotaPrivilege 3904 wmic.exe Token: SeSecurityPrivilege 3904 wmic.exe Token: SeTakeOwnershipPrivilege 3904 wmic.exe Token: SeLoadDriverPrivilege 3904 wmic.exe Token: SeSystemProfilePrivilege 3904 wmic.exe Token: SeSystemtimePrivilege 3904 wmic.exe Token: SeProfSingleProcessPrivilege 3904 wmic.exe Token: SeIncBasePriorityPrivilege 3904 wmic.exe Token: SeCreatePagefilePrivilege 3904 wmic.exe Token: SeBackupPrivilege 3904 wmic.exe Token: SeRestorePrivilege 3904 wmic.exe Token: SeShutdownPrivilege 3904 wmic.exe Token: SeDebugPrivilege 3904 wmic.exe Token: SeSystemEnvironmentPrivilege 3904 wmic.exe Token: SeRemoteShutdownPrivilege 3904 wmic.exe Token: SeUndockPrivilege 3904 wmic.exe Token: SeManageVolumePrivilege 3904 wmic.exe Token: 33 3904 wmic.exe Token: 34 3904 wmic.exe Token: 35 3904 wmic.exe Token: 36 3904 wmic.exe Token: SeIncreaseQuotaPrivilege 3904 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 208 wrote to memory of 4512 208 pcyyb__installer.exe 85 PID 208 wrote to memory of 4512 208 pcyyb__installer.exe 85 PID 208 wrote to memory of 3904 208 pcyyb__installer.exe 88 PID 208 wrote to memory of 3904 208 pcyyb__installer.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\pcyyb__installer.exe"C:\Users\Admin\AppData\Local\Temp\pcyyb__installer.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\System32\Wbem\wmic.exewmic path Win32_ComputerSystem get HypervisorPresent2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
-
C:\Windows\System32\Wbem\wmic.exewmic BaseBoard get Manufacturer2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3904
-