Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-11-2024 19:49
General
-
Target
PBCCRCPassGuardEdge.exe
-
Size
2.7MB
-
MD5
c0568331b9984599f57d7bbe11e17cd9
-
SHA1
4860334bc492832586a10f28aaa4c1e9c59ed847
-
SHA256
57a1929e2863a92d4e1dfdc5c0f34edfd28e7b7a8995a5afb5da3653d1ca4856
-
SHA512
cb58825cef114ca73eac6bbf5995077c5b34a627a36b5557c1be591aec5312b2ce1708b01cfe7db665f8586e3e5181e2ff455a487a2ea6718784ae8cbbd226f6
-
SSDEEP
49152:FtXXx7d5hSa3sWgOAhnvpAyw0rqMjdomso+NMnCPFLesr8xEZgCCDPLpGrpWBATJ:h7d5IalgOAjyaqM59sbNMnyezxEZ87LS
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PBCCRCPassGuardEdge.exe"C:\Users\Admin\AppData\Local\Temp\PBCCRCPassGuardEdge.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CheckNetIsolation.exeCheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exe"C:\Windows\system32\PBCCRCNew\PBCCRCPassGuardXInputService.exe" "-install"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardX.exe"C:\Windows\system32\PBCCRCNew\PBCCRCPassGuardX.exe" "-s"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInput.exeC:\Windows\system32\PBCCRCNew\PBCCRCPassGuardXInput.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\system32\schtasks.exe /delete /tn "ÈËÐÐÕ÷ÐÅ°²È«¿Ø¼þ°²È«ÊäÈë³ÌÐò" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn "ÈËÐÐÕ÷ÐÅ°²È«¿Ø¼þ°²È«ÊäÈë³ÌÐò" /tr "C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInput.exe" /sc onlogon3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exe"C:\Windows\system32\PBCCRCNew\PBCCRCPassGuardXInputService.exe" "-control" "PBCCRCPassGuardXInputService" "start"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\certmgr.exe"C:\Users\Admin\AppData\Local\Temp\certmgr.exe" -add "C:\Users\Admin\AppData\Local\Temp\wosign.cer" -c -s -r localMachine Root2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exeC:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exe1⤵
- Drops file in Drivers directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5ec58a1586ad70953d48e3c393163348f
SHA1f18eebaea4460b057f5b49e8239779f1c0c05bb9
SHA256a097cc322fa68e1ff500d79598f657d9c211e86e632c3c3b896e566852cea991
SHA51205615c1ee6aeaf82a1d52e31f18c4174ae4d44e96fcd4466643f01ef431d4ad5022f3b4eb07e9f472ea43b59e8de5f3b5c10328e7109dafa4c3f3b9ff41b2da2
-
Filesize
4KB
MD599f345cf51b6c3c317d20a81acb11012
SHA1b3d0355f527c536ea14a8ff51741c8739d66f727
SHA256c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
SHA512937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
-
Filesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
Filesize
6KB
MD516205cd992d3b3827573f93ab8923e4e
SHA14eece7a206ee619264d686ca1b3021b9f482866b
SHA256967d66f23cf3d9d3e5a4d6a9c6e366e792a98cc8a293196095b10cd82da9a695
SHA512257b2047b8e9303457bb050a760b8d2577da55642e4fb02933e6188d0591ff8adfe0c8df2a441577466f23a8e3bff2e94e9cfcfc381c4d255935123996c06d6d
-
Filesize
50KB
MD56b3a3f14e5e5e53ddcc884ec12d1cb3a
SHA170a0157b03568bd67b6b346fba30b1154d18eae0
SHA2565e3496961d0c3d97b3667b9cabd366acc29e6c2e53ff1c0780af0242f89a1155
SHA512424c1aab1348e3405d54ca1bef8d3325b845bba31ae7ccc24beff528fac33cfbf469c6127f918a6c02ba94982e7536d0b7dd8dfb3732f9206e340da2214c7cc1
-
Filesize
9KB
MD5e75ae7cfe06ff9692d98a934f6aa2d3c
SHA1d5fd4a59a39630c4693ce656bbbc0a55ede0a500
SHA2561f861aeb145ebbb9a2628414e6dca6b06d0bfb252f2de624b86814cfec8097d0
SHA512ab4998f8f6bbb60321d0c2aa941d4e85319901960297059bf0832cf84b18dfbb120c3aa71963b46d3be3b7c9602434cb23f9a961c00de02403b3f266b294d41b
-
Filesize
1019B
MD5252b7527e109b7320981a6fba6cd1084
SHA17c2106c955c997c65e5770a3326a12d304bcbb88
SHA256fb64c2459b8ae9851dbffe57d03f9a5dff98cdc0ad231391e4476868dddfff2f
SHA512d596172592128938f797ac1eba1b8b95c167d5abff6c8a4f5f37fd6c95c12621b8e7f20a2807a0f032ee695e5a7fc896580f194d8219bfa8b1b4c3b827895c94
-
Filesize
1.0MB
MD552e22babfbfaf59f14859e175856115d
SHA145dc92d8fc7f3aba824be0f0519c2844506a5960
SHA2567fa6544460b039457311bb310882c84801efa6c535e5ea360948803deb90c0e1
SHA512796568eae06ed17a81c7a36d392b8fd03ddbd76d746564f91a6d395fc8245453c1f574fc448d3cec93710abcc6c2e113c2df62fa4facd7b6676d7036855310bf
-
Filesize
2.2MB
MD5711a4cff055438d5d09ca435f0f14711
SHA11cd82ddcb7f0a6c03631e8f94d137ddfa056eb6d
SHA256e1a00202904b2606777b69c23bc6b432c68400ce2913c3e9bc480f4062957dec
SHA512cec702983ba3d1db5a6a06a9b5265d5943a1c5c5c015e15dc0d4fb34ab9443cea8285bd6b85db2f4f2ce69c49e59752bc9c3be7081c9d1346a2e57eaae155f9a
-
Filesize
325KB
MD5dc606c1a0dc7d554fb2f3f8f1d2388a7
SHA13119c24f69ea3b5e595100ba8a05badb2e49fcdc
SHA25624550160fdf34fac8895da3f8799dc284654222291803a006302a60ef5299407
SHA512cd4246dd524821f262907721ef22231fa505afae135abe6dfe1bd100765644446a084f857ae52502ef4ab307b8f3ea3c992938b471a54c2b9482435bad823f9f
-
Filesize
1KB
MD5968ab70c39075e153d8b428a35bb35ee
SHA1f77ecb8149d40b863223b78f74d9f61a72ba2708
SHA256017ad4115c1ea7a1800eaca673e2b4425518be939e69eb08be2188fc6ab178db
SHA512d73edac4fbeee7bdd3ff9ff92a86ea9138ab096a8e3012ba429352faf3b46f9358b0f21336bbfe6f46a8975f966313b5d460e2bef0802fe7cb2d36027f73cdc8
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.0MB
-
Filesize
2.2MB
