88977075356dc9e4c81ff59e5ffc004ab3d62070c1062ce7b690a941d5328090 | Triage

Analysis

max time kernel
142s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 14:07

Sharing

Report Analysis Logs

General

Target

PCWProtectorDummy64.exe
Size

501KB
MD5

4e4009a8838142a76a1d3b7e9a72b0a2
SHA1

fce0ef120d20a322afbc0a0e8c942c69f2218e85
SHA256

3668f959946e719f5a72cc7c5311adf9e8dc5a13d94ca6e0b994d3a520adf881
SHA512

186de07c13518bbffc8eae9857228a4b51080fe409cd7499d9a9c1575a9cd2229c1d20418f121380e7b730ea9404595070b1b4f7ad55354472a9de49ac5a2d17
SSDEEP

12288:kvzgBGfHGKKZ/W25AbMomlOpMVDt9pGHNu4B2UH:UtKZHAbMoUOSQI4rH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	PCWProtectorDummy64.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1972	PCWProtectorDummy64.exe
1972	PCWProtectorDummy64.exe

C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
"C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4244 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:3928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads