88977075356dc9e4c81ff59e5ffc004ab3d62070c1062ce7b690a941d5328090

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PCWProtectorService64B.exe
Size

287KB
MD5

eb2aa21de1026a8a831af0797aac9a78
SHA1

0e5e03f209a50a46ac14246ae46ef19ee14d7233
SHA256

82c4c819c4d543f6131cbc462206e9cdaf4931abe6f73c21b6df4968897572a2
SHA512

89758110eef34b9c08b09cfb10569b0ce4b16788dc68029c12fda84859240d514d2a41827a61e99b9e2a8f1be1ce251a2fd8aeba990dfbb176158f6096ad11e2
SSDEEP

6144:sV7FOaQwYB3EOkbu/s6vsHgf4t7hGijknN+kh/h4:sxQwYB3E1u/n87hAnz9h4

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TftLib.dll	PCWProtectorService64B.exe
File opened for modification	C:\Windows\SysWOW64\TftLib.dll	PCWProtectorService64B.exe
File created	C:\Windows\SysWOW64\T_Prevent.dll	PCWProtectorService64B.exe
File created	C:\Windows\SysWOW64\TDepend.exe	PCWProtectorService64B.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe
4048	PCWProtectorService64B.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	PCWProtectorService64B.exe
Token: SeDebugPrivilege	4048	PCWProtectorService64B.exe
Token: SeDebugPrivilege	4048	PCWProtectorService64B.exe
Token: SeDebugPrivilege	4048	PCWProtectorService64B.exe
Token: SeDebugPrivilege	4048	PCWProtectorService64B.exe
Token: SeDebugPrivilege	4048	PCWProtectorService64B.exe
Token: SeDebugPrivilege	4048	PCWProtectorService64B.exe

C:\Users\Admin\AppData\Local\Temp\PCWProtectorService64B.exe
"C:\Users\Admin\AppData\Local\Temp\PCWProtectorService64B.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\TftLib.dll

Filesize
254KB

MD5
7bc750a3e94403913851e41f1028a832

SHA1
d035d67133c760b48522713bd3158ec2bf17fcbc

SHA256
64aaa65abb2d5cfd49c96d349dec267e904457ec70c91fa64d0ee60b0b155817

SHA512
8de51b3bb24cedf37a8a138f5c6177d3f8ad3602b81d387a129b2a7662c53ffe91afbba09b9f26844de535bab29ade8da7e25621efbc032e903882dda3974d61

Download Submit