Overview

overview

7

Static

static

3

SSDRM_for_...1).exe

windows7-x64

7

SSDRM_for_...1).exe

windows10-2004-x64

3

$PLUGINSDI...md.dll

windows7-x64

3

$PLUGINSDI...md.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

PCWProtect...ce.exe

windows7-x64

7

PCWProtect...ce.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...in.dll

windows7-x64

3

$PLUGINSDI...in.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

GDISpy.sys

windows7-x64

1

GDISpy.sys

windows10-2004-x64

1

GDISpyB.sys

windows7-x64

1

GDISpyB.sys

windows10-2004-x64

1

PCW.dll

windows7-x64

1

PCW.dll

windows10-2004-x64

1

PCW64.dll

windows7-x64

7

PCW64.dll

windows10-2004-x64

7

PCWProtectorB.exe

windows7-x64

1

PCWProtectorB.exe

windows10-2004-x64

1

PCWProtectorDummy.exe

windows7-x64

1

PCWProtectorDummy.exe

windows10-2004-x64

1

PCWProtect...64.exe

windows7-x64

1

PCWProtect...64.exe

windows10-2004-x64

1

PCWProtect...4B.exe

windows7-x64

5

PCWProtect...4B.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24/04/2024, 14:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PCWProtectorService64B.exe

  • Size

    287KB

  • MD5

    eb2aa21de1026a8a831af0797aac9a78

  • SHA1

    0e5e03f209a50a46ac14246ae46ef19ee14d7233

  • SHA256

    82c4c819c4d543f6131cbc462206e9cdaf4931abe6f73c21b6df4968897572a2

  • SHA512

    89758110eef34b9c08b09cfb10569b0ce4b16788dc68029c12fda84859240d514d2a41827a61e99b9e2a8f1be1ce251a2fd8aeba990dfbb176158f6096ad11e2

  • SSDEEP

    6144:sV7FOaQwYB3EOkbu/s6vsHgf4t7hGijknN+kh/h4:sxQwYB3E1u/n87hAnz9h4

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PCWProtectorService64B.exe
    "C:\Users\Admin\AppData\Local\Temp\PCWProtectorService64B.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\TftLib.dll
    Filesize

    254KB

    MD5

    7bc750a3e94403913851e41f1028a832

    SHA1

    d035d67133c760b48522713bd3158ec2bf17fcbc

    SHA256

    64aaa65abb2d5cfd49c96d349dec267e904457ec70c91fa64d0ee60b0b155817

    SHA512

    8de51b3bb24cedf37a8a138f5c6177d3f8ad3602b81d387a129b2a7662c53ffe91afbba09b9f26844de535bab29ade8da7e25621efbc032e903882dda3974d61

    Download Submit