Analysis
- max time kernel
21s - max time network
20s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
21/02/2024, 22:40
General
- Target PCMgr_Setup.exe
- Size 175.4MB
- Sample240221-2llagagg56
- SHA256 d605f22b61ac32bcb41db457e285f39126e328c242c810ba2fa5e451318dc7d6
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 3 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PCMgr_Setup.exe"C:\Users\Admin\AppData\Local\Temp\PCMgr_Setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5838af\TestMSVCR.exe"C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5838af\TestMSVCR.exe" (null)2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5838af\InstAsm.exe"C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5838af\InstAsm.exe" "C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5838af" "C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5838af\TestMSVCR.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
QQPCMgrInstall_20240221224154.Log
InstAsm.exe
PackageConf.dll
PackageConf.dll
TestMSVCR.exe
dr.dll
memory/3232-82-0x0000000000400000-0x0000000000406000-memory.dmp
memory/4444-46-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/4444-74-0x0000000010340000-0x00000000103AD000-memory.dmp