1f7f13aa248c139832d4eda0405aed97ded646e21e6cf111f44e0f617befe16b

Analysis

max time kernel
126s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2023, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.7MB
Sample230723-26tscaha79
SHA256 1f7f13aa248c139832d4eda0405aed97ded646e21e6cf111f44e0f617befe16b
MD5 06ff231ed95864996a4920d5a4e0bd81
SHA1 0f9a0fdf9a72b97fdd13190822ced7ab8fbecd52
SHA512 45bf48afce76343dbcb6857c0e4b63f2c5ae9e7767f181fbe346bf63abdf4a7fcfd6cd48f90ff2ba697e51100b3541b51f07bdff43b02ffcd5ed32783e0f37d7
SSDEEP 24576:fpzG+NXdmGh5Z8YE2f2rVFVUa0oKHlDXYQHyhfZrsNrs+4IFw:f0+Nt9h5Z80urbVH0oYdHiCA+v
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	PCELK.exe

Executes dropped EXE 1 IoCs

pid	Process
5028	PCELK.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3920	5028	WerFault.exe	101

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4936	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3236	timeout.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4068	file.exe
Token: SeDebugPrivilege	5028	PCELK.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 860	4068	file.exe	98
PID 4068 wrote to memory of 860	4068	file.exe	98
PID 860 wrote to memory of 3236	860	cmd.exe	100
PID 860 wrote to memory of 3236	860	cmd.exe	100
PID 860 wrote to memory of 5028	860	cmd.exe	101
PID 860 wrote to memory of 5028	860	cmd.exe	101
PID 5028 wrote to memory of 3660	5028	PCELK.exe	103
PID 5028 wrote to memory of 3660	5028	PCELK.exe	103
PID 3660 wrote to memory of 4936	3660	cmd.exe	105
PID 3660 wrote to memory of 4936	3660	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9BED.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3236
- - C:\ProgramData\BinEngFrame\PCELK.exe
    "C:\ProgramData\BinEngFrame\PCELK.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PCELK" /tr "C:\ProgramData\BinEngFrame\PCELK.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3660
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PCELK" /tr "C:\ProgramData\BinEngFrame\PCELK.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:4936
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 5028 -s 1316
      4⤵
      Program crash
      PID:3920

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 428 -p 5028 -ip 5028
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PCELK.exe

Path C:\ProgramData\BinEngFrame\PCELK.exe
Size 789.0MB
SHA256 9d3cae709730985bb3ea455c2ba5bc65fcbdfe7533c0a74b752892536ae57377
MD5 f8b501e7a2006daecf2d6b3122e47d73
SHA1 1a041cbb34958119fdfc51b4be5704604169935b
SHA512 b7b606e6c3dc60a17157a078371dc3f1e2e3132978280346de8a0ea60e04a17dc2bbff9996c12ae976687e2395e5be7bd0bc1e6ca9764fe707b20cd2498c1a2f
SSDEEP 24576:fpzG+NXdmGh5Z8YE2f2rVFVUa0oKHlDXYQHyhfZrsNrs+4IFw:f0+Nt9h5Z80urbVH0oYdHiCA+v
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCELK.exe

Path C:\ProgramData\BinEngFrame\PCELK.exe
Size 789.0MB
SHA256 9d3cae709730985bb3ea455c2ba5bc65fcbdfe7533c0a74b752892536ae57377
MD5 f8b501e7a2006daecf2d6b3122e47d73
SHA1 1a041cbb34958119fdfc51b4be5704604169935b
SHA512 b7b606e6c3dc60a17157a078371dc3f1e2e3132978280346de8a0ea60e04a17dc2bbff9996c12ae976687e2395e5be7bd0bc1e6ca9764fe707b20cd2498c1a2f
SSDEEP 24576:fpzG+NXdmGh5Z8YE2f2rVFVUa0oKHlDXYQHyhfZrsNrs+4IFw:f0+Nt9h5Z80urbVH0oYdHiCA+v
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp9BED.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp9BED.tmp.bat
Size 145B
SHA256 cb60f5d4392ee72aa9463a4594cb56a4d817d6846bfbc3db2bbf109e2af555aa
MD5 066a86d8cac1950cb681af3e7d722b1a
SHA1 bd964349a6a8930204d42edcd570a88c55f27293
SHA512 2aa0d4ce381eb6bee29328bc3633edc58a4591ff4ab3f56fc9c3b4041cdff594a08f0c7eab38ef7e01223da9b3d5409d9d08977a38359b28c483ffc894b45f7b
MD5 SHA1 SHA512

Submit Download

memory/4068-138-0x00007FF8C1EE0000-0x00007FF8C29A1000-memory.dmp

Download

memory/4068-133-0x00000000005E0000-0x000000000079E000-memory.dmp

Download

memory/4068-139-0x000000001C320000-0x000000001C330000-memory.dmp

Download

memory/4068-145-0x00007FF8C1EE0000-0x00007FF8C29A1000-memory.dmp

Download

memory/4068-136-0x0000000001130000-0x0000000001131000-memory.dmp

Download

memory/4068-135-0x000000001C320000-0x000000001C330000-memory.dmp

Download

memory/4068-134-0x00007FF8C1EE0000-0x00007FF8C29A1000-memory.dmp

Download

memory/5028-150-0x00007FF8C1760000-0x00007FF8C2221000-memory.dmp

Download

memory/5028-151-0x000000001C160000-0x000000001C170000-memory.dmp

Download

memory/5028-152-0x0000000000D70000-0x0000000000D71000-memory.dmp

Download

memory/5028-155-0x00007FF8C1760000-0x00007FF8C2221000-memory.dmp

Download

memory/5028-156-0x000000001C160000-0x000000001C170000-memory.dmp

Download

memory/5028-157-0x00007FF8C1760000-0x00007FF8C2221000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads