75f5fae8f75dfa54e7ff3dae1fd76234ac2948d91d7238b6458003ec2ed37b70

General

Target

0e0eff7079eff8797680109cb9fdcb6c.exe
Size

1.9MB
MD5

0e0eff7079eff8797680109cb9fdcb6c
SHA1

875b4b657cfa08d1521fd6d9910962230c2a14b4
SHA256

75f5fae8f75dfa54e7ff3dae1fd76234ac2948d91d7238b6458003ec2ed37b70
SHA512

c7c3833109bf7458c2e9cd4229d69e37c9823bbe783c64d3b4c4fa0b2c842c73c76ecf280121d400af492ad609aaddbc910dbc5643f9bb2d47b8a023bac7a879
SSDEEP

49152:1bF0xWdc/eS4exnHZi18axvXP8l33t1JFCGLvEcTIMMdY17V:ZF0x8c/11HBGv/WHtUQvx/yY15

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\PCenter\\pc.exe"	0e0eff7079eff8797680109cb9fdcb6c.exe

Executes dropped EXE 1 IoCs

pid	Process
3852	agent.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\agent.exe = "C:\\Program Files (x86)\\PCenter\\agent.exe"	0e0eff7079eff8797680109cb9fdcb6c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PCenter\faq\images\gimg1.jpg	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\faq\images\gimg8.jpg	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\pc.exe	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\faq\guide.html	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\faq\images\gimg3.jpg	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\faq\images\gimg5.jpg	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\faq\images\gimg6.jpg	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\faq\images\gimg9.jpg	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\sounds\1.mp3	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\sounds\3.mp3	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\faq\images\gimg10.jpg	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\faq\images\gimg4.jpg	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\agent.exe	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\faq\images\gimg2.jpg	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\faq\images\gimg7.jpg	0e0eff7079eff8797680109cb9fdcb6c.exe
File created	C:\Program Files (x86)\PCenter\uninstall.exe	0e0eff7079eff8797680109cb9fdcb6c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3852	agent.exe
3852	agent.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3852	agent.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3852	agent.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 3852	4936	0e0eff7079eff8797680109cb9fdcb6c.exe	91
PID 4936 wrote to memory of 3852	4936	0e0eff7079eff8797680109cb9fdcb6c.exe	91
PID 4936 wrote to memory of 3852	4936	0e0eff7079eff8797680109cb9fdcb6c.exe	91

C:\Users\Admin\AppData\Local\Temp\0e0eff7079eff8797680109cb9fdcb6c.exe
"C:\Users\Admin\AppData\Local\Temp\0e0eff7079eff8797680109cb9fdcb6c.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files (x86)\PCenter\agent.exe
  "C:\Program Files (x86)\PCenter\agent.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PCenter\agent.exe

Filesize
541KB

MD5
893983756a19025823ef5598c3f8a47b

SHA1
0cc2d67f60ef197dcce35cc1c879fe1d7cf8e619

SHA256
cc2756cc651647c911a668eb0a5da3275352ef7b9459790947bced71c11ef495

SHA512
f65ed9e247b0364996259dff42ead29f79e5923f707827c2ffb2e2fcde97578c9ca41a23aebb848b50b3914c7bb515598230bc02d8e0ecef7de1eee4fcc5d5cf

Download Submit
memory/3852-29-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/3852-30-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3852-32-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/3852-36-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads