57a1929e2863a92d4e1dfdc5c0f34edfd28e7b7a8995a5afb5da3653d1ca4856

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PBCCRCPassGuardEdge.exe
Size

2.7MB
MD5

c0568331b9984599f57d7bbe11e17cd9
SHA1

4860334bc492832586a10f28aaa4c1e9c59ed847
SHA256

57a1929e2863a92d4e1dfdc5c0f34edfd28e7b7a8995a5afb5da3653d1ca4856
SHA512

cb58825cef114ca73eac6bbf5995077c5b34a627a36b5557c1be591aec5312b2ce1708b01cfe7db665f8586e3e5181e2ff455a487a2ea6718784ae8cbbd226f6
SSDEEP

49152:FtXXx7d5hSa3sWgOAhnvpAyw0rqMjdomso+NMnCPFLesr8xEZgCCDPLpGrpWBATJ:h7d5IalgOAjyaqM59sbNMnyezxEZ87LS

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3104	PBCCRCPassGuardEdge.exe
3104	PBCCRCPassGuardEdge.exe
3104	PBCCRCPassGuardEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\PBCCRCPassGuardEdge.exe
"C:\Users\Admin\AppData\Local\Temp\PBCCRCPassGuardEdge.exe"
1⤵
- Loads dropped DLL
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3536 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsw905.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw905.tmp\nsDialogs.dll

Filesize
9KB

MD5
e75ae7cfe06ff9692d98a934f6aa2d3c

SHA1
d5fd4a59a39630c4693ce656bbbc0a55ede0a500

SHA256
1f861aeb145ebbb9a2628414e6dca6b06d0bfb252f2de624b86814cfec8097d0

SHA512
ab4998f8f6bbb60321d0c2aa941d4e85319901960297059bf0832cf84b18dfbb120c3aa71963b46d3be3b7c9602434cb23f9a961c00de02403b3f266b294d41b

Download Submit