Analysis
-
max time kernel
54s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 17:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PyCE.zip
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
PyCE/Fixer.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
PyCE/installer.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
PyCE/main.py
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
PyCE/installer.bat
-
Size
174B
-
MD5
6c18ff724e7e62381bc7a8682a023ec9
-
SHA1
2da2e82eaf39e97fb6e919fe3b602be010dfc10d
-
SHA256
65ce7f137a5f9d35c4e19d574347fdaefea186c69a0b89971e59ed41fb0177fc
-
SHA512
8fc67ee2dc92eec6505e1a8707264c957f4f7ac7171dba320dfcf40a8df36cb621ea27868c79a0f672a94bb6dee8b5048bd1068b8f2fd75dc6dafe4aa036e3ed
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3124 taskmgr.exe Token: SeSystemProfilePrivilege 3124 taskmgr.exe Token: SeCreateGlobalPrivilege 3124 taskmgr.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PyCE\installer.bat"1⤵PID:4532
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3124