Analysis
- max time kernel
141s - max time network
122s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
- submitted
07/05/2024, 11:49
General
- Target $APPDATA/Microsoft/Internet Explorer/Quick Launch/pcmaster.exe
- Size 6.9MB
- Sample240507-nzeg7aee8t
- SHA256 8a770b4d23ad9ebd4c35b4f95cc340263efcfdf0ae2b3f4e0da0e3f1bca49201
Malware Config
Signatures
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$APPDATA\Microsoft\Internet Explorer\Quick Launch\pcmaster.exe"C:\Users\Admin\AppData\Local\Temp\$APPDATA\Microsoft\Internet Explorer\Quick Launch\pcmaster.exe"1⤵
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\$APPDATA\Microsoft\Internet Explorer\Quick Launch\rmup.exe"C:\Users\Admin\AppData\Local\Temp\$APPDATA\Microsoft\Internet Explorer\Quick Launch\rmup.exe" -pcmaster6 -silent2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\pcmaster\pcmastersvc.exeC:\Users\Admin\AppData\Roaming\pcmaster\pcmastersvc.exe /i2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\pcmaster\pcmastersvc.exeC:\Users\Admin\AppData\Roaming\pcmaster\pcmastersvc.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Cab988D.tmp
Tar98ED.tmp
winguard.cfg
pcmastersvc.exe
memory/2424-114-0x0000000000400000-0x0000000000DD7000-memory.dmp
memory/2424-125-0x0000000000400000-0x0000000000DD7000-memory.dmp
memory/2424-75-0x0000000000400000-0x0000000000DD7000-memory.dmp
memory/2424-34-0x0000000073960000-0x00000000739FD000-memory.dmp
memory/2424-33-0x0000000073AD0000-0x0000000073B3C000-memory.dmp
memory/2424-83-0x0000000073AD0000-0x0000000073B3C000-memory.dmp
memory/2424-82-0x0000000000400000-0x0000000000DD7000-memory.dmp
memory/2424-0-0x0000000000400000-0x0000000000DD7000-memory.dmp
memory/2424-77-0x0000000000EC0000-0x0000000000EC1000-memory.dmp
memory/2424-3-0x0000000000EC0000-0x0000000000EC1000-memory.dmp
memory/2424-74-0x0000000000400000-0x0000000000DD7000-memory.dmp
memory/3000-51-0x00000000047A0000-0x00000000048C8000-memory.dmp
memory/3000-55-0x00000000735B0000-0x000000007364D000-memory.dmp
memory/3000-68-0x0000000073850000-0x00000000738BC000-memory.dmp
memory/3000-67-0x0000000073850000-0x00000000738BC000-memory.dmp
memory/3000-66-0x00000000735E0000-0x000000007364C000-memory.dmp
memory/3000-65-0x0000000072A40000-0x0000000072ADD000-memory.dmp
memory/3000-64-0x00000000735F0000-0x0000000073648000-memory.dmp
memory/3000-63-0x00000000047A0000-0x0000000004AD0000-memory.dmp
memory/3000-62-0x00000000047A0000-0x0000000004AD0000-memory.dmp
memory/3000-61-0x0000000073850000-0x00000000738BC000-memory.dmp
memory/3000-60-0x00000000047A0000-0x0000000004944000-memory.dmp
memory/3000-59-0x00000000047A0000-0x0000000004944000-memory.dmp
memory/3000-58-0x00000000047A0000-0x0000000004895000-memory.dmp
memory/3000-57-0x00000000735F0000-0x0000000073648000-memory.dmp
memory/3000-56-0x0000000073860000-0x00000000738B8000-memory.dmp
memory/3000-69-0x00000000735E0000-0x000000007364C000-memory.dmp
memory/3000-54-0x00000000047A0000-0x0000000005177000-memory.dmp
memory/3000-70-0x00000000735B0000-0x000000007364D000-memory.dmp
memory/3000-71-0x0000000073850000-0x00000000738BC000-memory.dmp
memory/3000-53-0x00000000047A0000-0x0000000005177000-memory.dmp
memory/3000-48-0x00000000047A0000-0x0000000004963000-memory.dmp
memory/3000-52-0x00000000047A0000-0x00000000049F2000-memory.dmp
memory/3000-50-0x00000000047A0000-0x00000000048C8000-memory.dmp
memory/3000-85-0x00000000047A0000-0x0000000004963000-memory.dmp
memory/3000-86-0x00000000047A0000-0x00000000048C8000-memory.dmp
memory/3000-87-0x00000000047A0000-0x00000000048C8000-memory.dmp
memory/3000-88-0x0000000073860000-0x00000000738B8000-memory.dmp
memory/3000-89-0x00000000047A0000-0x0000000004AD0000-memory.dmp
memory/3000-49-0x00000000047A0000-0x0000000004963000-memory.dmp
memory/3000-47-0x00000000047A0000-0x00000000048E1000-memory.dmp
memory/3000-44-0x00000000046A0000-0x0000000005077000-memory.dmp
memory/3000-43-0x00000000046A0000-0x0000000005077000-memory.dmp