21817cd11609a602c97437f50b37c037ac8fdf1ab2febbe742d3d271b44f2ab7

General

Target

b8f3af9de7b3a6bbdf813b87160295a8.exe
Size

297KB
MD5

b8f3af9de7b3a6bbdf813b87160295a8
SHA1

b92fc9ec19246d62fcb8e4ff4af89fc8ada509e3
SHA256

21817cd11609a602c97437f50b37c037ac8fdf1ab2febbe742d3d271b44f2ab7
SHA512

5edd4aae61af8d7643c6fd4275481eb09bf2218c7ab4e972a540d3b2441f4fb74db37375fdde433a0ccc680df85091cf368d182d044d727d0802f360e655601a
SSDEEP

6144:HTdiRzRz45GumLNGJVUYc8r10tAcKovjEqMeM/xmosN5:zdaOGumLNGoYc85Tc5vjMXB

Score

7^/10

persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	b8f3af9de7b3a6bbdf813b87160295a8.exe

Executes dropped EXE 1 IoCs

pid	Process
1308	pviever.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4164-0-0x0000000000400000-0x00000000004CB000-memory.dmp	upx
behavioral2/files/0x000c00000002312e-6.dat	upx
behavioral2/memory/4164-11-0x0000000000400000-0x00000000004CB000-memory.dmp	upx
behavioral2/memory/1308-10-0x0000000000400000-0x00000000004CB000-memory.dmp	upx
behavioral2/memory/1308-14-0x0000000000400000-0x00000000004CB000-memory.dmp	upx
behavioral2/memory/1308-15-0x0000000000400000-0x00000000004CB000-memory.dmp	upx
behavioral2/memory/1308-16-0x0000000000400000-0x00000000004CB000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PViever = "\"C:\\Program Files\\PViever\\pviever.exe\" hide"	b8f3af9de7b3a6bbdf813b87160295a8.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\PViever\pviever.exe	b8f3af9de7b3a6bbdf813b87160295a8.exe
File created	C:\Program Files\PViever\uin.txt	pviever.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	pviever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	pviever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	pviever.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	pviever.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	pviever.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	pviever.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	pviever.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	pviever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	pviever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	pviever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	pviever.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	pviever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	pviever.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	pviever.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	pviever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	pviever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	pviever.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	pviever.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1308	pviever.exe
1308	pviever.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 1308	4164	b8f3af9de7b3a6bbdf813b87160295a8.exe	88
PID 4164 wrote to memory of 1308	4164	b8f3af9de7b3a6bbdf813b87160295a8.exe	88
PID 4164 wrote to memory of 1308	4164	b8f3af9de7b3a6bbdf813b87160295a8.exe	88

C:\Users\Admin\AppData\Local\Temp\b8f3af9de7b3a6bbdf813b87160295a8.exe
"C:\Users\Admin\AppData\Local\Temp\b8f3af9de7b3a6bbdf813b87160295a8.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files\PViever\pviever.exe
  "C:\Program Files\PViever\pviever.exe" hide 10000
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\PViever\pviever.exe

Filesize
297KB

MD5
b8f3af9de7b3a6bbdf813b87160295a8

SHA1
b92fc9ec19246d62fcb8e4ff4af89fc8ada509e3

SHA256
21817cd11609a602c97437f50b37c037ac8fdf1ab2febbe742d3d271b44f2ab7

SHA512
5edd4aae61af8d7643c6fd4275481eb09bf2218c7ab4e972a540d3b2441f4fb74db37375fdde433a0ccc680df85091cf368d182d044d727d0802f360e655601a

Download Submit
memory/1308-10-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1308-12-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1308-14-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1308-15-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1308-16-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1308-17-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/4164-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/4164-1-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/4164-11-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads