88977075356dc9e4c81ff59e5ffc004ab3d62070c1062ce7b690a941d5328090 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 14:07

Sharing

Report Analysis Logs

General

Target

PCWProtectorB.exe
Size

567KB
MD5

6ce74b64aee3c89d3939bb15ecfe7888
SHA1

58ec5c6b43b90aaa6fa7919c1dbf46812378efae
SHA256

ccb0bd5f3e296c35b38348cf4f231f93ce9bb57af42c328b0aba9e29103ee391
SHA512

f39486655c3d58a62d5c310ce181da0f7dee61e2d3179571b6c1e25ceba3b20c9061565708b8e7c5c5232ca3210348ed82305a105b3b678fadef7b62a2be8c64
SSDEEP

12288:D2mLG5GELDDx5HXt/NoUSppY+ATabo9pGHNu4B2Uehy:0rtNoUSj/AeI4reA

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	PCWProtectorB.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe
1648	PCWProtectorB.exe

C:\Users\Admin\AppData\Local\Temp\PCWProtectorB.exe
"C:\Users\Admin\AppData\Local\Temp\PCWProtectorB.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads