Analysis
- user interaction
yes - max time kernel
10s - max time network
12s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 17:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PCBS2 Trainer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
PCBS2 Trainer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target PCBS2 Trainer.exe
- Size 7.1MB
- Sample260803-v6mkpsgl8s
- SHA256 b0a9da972f5d49b94838dcf88fff30dbba700186248b6482d69f4adaebfcfdc7
- MD5 394f6c80b833c1b1dcba6b5b3c923e38
- SHA1 81488c26898c0851fa4a461fa736694298b9ec9f
- SHA512 3d4e63d8e6b71abc820afed74825cc79e3fe644246d56983e185a24bee8a07677711497624fd57f51f27dca9443f48080c3e1235660166e4105741b6dc722959
- SSDEEP 196608:uvpFqRWjY8QskNxtB+16XFKRZCfuFtmPeW09bbG5D:qpFq6Y5sm+42Z2sEPeW01mD
- TLSH T15E763319F641D337D8877AF6EF91ABE38361A9316C73C096F6DD260ACFB1A409E05106
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4360 PCBS2 Trainer.exe 3192 PCBS2 Trainer.exe - Loads dropped DLL 1 IoCs
pid Process 3192 PCBS2 Trainer.exe - Drops file in System32 directory 43 IoCs
description ioc Process File opened for modification C:\Windows\System32\user32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\advapi32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\imm32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\uxtheme.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\msimg32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\kernel.appcore.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\bcryptPrimitives.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\clbcatq.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\imagehlp.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\opengl32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\wininet.dll PCBS2 Trainer.exe File opened for modification C:\Windows\system32\shfolder.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\profapi.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\CFGMGR32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\MSCTF.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\KERNELBASE.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\ucrtbase.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\shlwapi.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\comdlg32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\shell32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\version.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\hhctrl.ocx PCBS2 Trainer.exe File opened for modification C:\Windows\system32\explorerframe.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\ntdll.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\msvcp_win.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\RPCRT4.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\GDI32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\msvcrt.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\psapi.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\dxcore.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\PROPSYS.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\shcore.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\wsock32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\GLU32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\KERNEL32.DLL PCBS2 Trainer.exe File opened for modification C:\Windows\System32\combase.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\win32u.dll PCBS2 Trainer.exe File opened for modification C:\Windows\SYSTEM32\windows.storage.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\oleaut32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\gdi32full.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\sechost.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\ole32.dll PCBS2 Trainer.exe File opened for modification C:\Windows\System32\ws2_32.dll PCBS2 Trainer.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\comctl32.dll PCBS2 Trainer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCBS2 Trainer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCBS2 Trainer.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ PCBS2 Trainer.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3192 PCBS2 Trainer.exe 3192 PCBS2 Trainer.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 3192 PCBS2 Trainer.exe Token: SeTcbPrivilege 3192 PCBS2 Trainer.exe Token: SeTcbPrivilege 3192 PCBS2 Trainer.exe Token: SeLoadDriverPrivilege 3192 PCBS2 Trainer.exe Token: SeCreateGlobalPrivilege 3192 PCBS2 Trainer.exe Token: SeLockMemoryPrivilege 3192 PCBS2 Trainer.exe Token: 33 3192 PCBS2 Trainer.exe Token: SeSecurityPrivilege 3192 PCBS2 Trainer.exe Token: SeTakeOwnershipPrivilege 3192 PCBS2 Trainer.exe Token: SeManageVolumePrivilege 3192 PCBS2 Trainer.exe Token: SeBackupPrivilege 3192 PCBS2 Trainer.exe Token: SeCreatePagefilePrivilege 3192 PCBS2 Trainer.exe Token: SeShutdownPrivilege 3192 PCBS2 Trainer.exe Token: SeRestorePrivilege 3192 PCBS2 Trainer.exe Token: 33 3192 PCBS2 Trainer.exe Token: SeIncBasePriorityPrivilege 3192 PCBS2 Trainer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3192 PCBS2 Trainer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3524 wrote to memory of 4360 3524 PCBS2 Trainer.exe 89 PID 4360 wrote to memory of 3192 4360 PCBS2 Trainer.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\PCBS2 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\PCBS2 Trainer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC2FD.tmp\PCBS2 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC2FD.tmp\PCBS2 Trainer.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC2FD.tmp\extracted\PCBS2 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC2FD.tmp\extracted\PCBS2 Trainer.exe" "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC2FD.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3192
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC2FD.tmp\CET_Archive.dat
- Size 6.8MB
- SHA256 f5a4ac01416e1322a62d580bb68c81ecf8268b49c10513200b837e473a3279a4
- MD5 580a9239ddf373ea9015bfe6f9c536f3
- SHA1 8c11e16abd9df224a35ce8a7ebc15d3c8289986b
- SHA512 7f981dc2b687c7d87814e66b77aae94336349b0354e9257e2686824f416d7700740a477ad273ef24c02346da9befffa9b5947c92fed7fb75687a8314498c4356
- SSDEEP 196608:kvpFqRWjY8QskNxtB+16XFKRZCfuFtmPeW09bbG5I:kpFq6Y5sm+42Z2sEPeW01mI
- TLSH T15D763309C981F77CED93ABBBFB933C87D299A453E4A7D554CA5E90028FE3A01198540F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC2FD.tmp\PCBS2 Trainer.exe
- Size 189KB
- SHA256 dab3003436b6861ae220cc5fdcb97970fc05afdf114c2f91e46eed627ce3d6af
- MD5 a65c29111a4cf5a7fdd5a9d79f77bcab
- SHA1 c0c59b1f792c975558c33a3b7cf0d94adc636660
- SHA512 b37ef3351e8f46f7183550254acce99b54e0199fc37a02cca78b471dc2d8b697769afdaf7e6cfe89422cfed65a8dcc6d158ef52aba5b0ac9350ea05607fefd7f
- SSDEEP 3072:/bpNXPzitxNyVg64pEIP9lz3mjoOejfyyswe710LJNEXvXO29s6l8Bji1u78xb/1:/1NXPQNyVg64p5P9lz33OezRswe710Ll
- TLSH T1C4144C95E742833BC4437EF54B8985F65A70EB242D31C0EB32D90B0EDBB5EA06E35256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC2FD.tmp\extracted\CET_TRAINER.CETRAINER
- Size 1.1MB
- SHA256 f5e278eb978c56db5bca32382bdce0564fb5114f15becf8ccf2720ff5147e5b6
- MD5 42a2a84cff3fddb664aaffe2604643cb
- SHA1 fec9eb36237e687902dd52b87abb1b0f547a1667
- SHA512 7a66f8c0f2c9c481c286f1c35e864949f9e2da6349d2e8469916a2e1702429af2e01faaac94684f41c23a0f734b3931e8019e263eb4280717ba840823b7ab000
- SSDEEP 24576:4DuHIp3wlmoGGEuPGVsPHih/+4G3g/rFuLI3xGLDqU27ruYzgg4RygGNf:cuHIp3wlm8OVsP/gTzxGaU2eY92ygK
- TLSH T16145338C22809B787ED3E1A77AC37CBC7E26607651F66674C8CB1A05CC6106E2F8D653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC2FD.tmp\extracted\PCBS2 Trainer.exe
- Size 14.7MB
- SHA256 394725de3465afbacbe15eed1e20f7ec2797793e49dae0cc781da3d1bb6b858c
- MD5 f65d9c8718301221b5c856aa773bc1f3
- SHA1 33f4b4fec1d363644a7d827664a2747aa5324ead
- SHA512 a5ac9382d3549e45ec0dcb7b36547c7fa0bfaf4d570be743953b273e90a12a2e84167f734774ae7c64693c7cd9c77462d4288d535f032c0b2b2baac5cd6c27bc
- SSDEEP 196608:pd9uReeUlaWFzcDVbqjqQOwAomFtH6ayTTkMD6gOkZC:p2ReeUlaWFzcxbq2nwAomHHins8ZC
- TLSH T172F64BBBB261DAD9C0CAC1B594C28BF15F30BD2449B5134323D5371EDFB68806E99D8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC2FD.tmp\extracted\defines.lua
- Size 11KB
- SHA256 30b816a90abbe520bcb6606d022f3c870a72ad05a94522ff64b8395bfc088e67
- MD5 50ddb39ece0aabd0e709adfc15f93ce2
- SHA1 56398bc80ff7235fd429b0ba557e0681fbdab7a6
- SHA512 36fabd7f88f8895f2561d5983a6243781ddefea711d9905a0870daa24f95928ea4af72258e7c842f9c4df9dd2553ef9b67a4f5cdc1f3a75e54cd38070465c66c
- SSDEEP 192:0egHuderGTd4G9mSZk/8fdtINfbLmJFcSC5xm+9qh07EBS5perFrLUK80u9E3:AHuderlSZk/8FtIF4umMqEpCg3fS
- TLSH T10642845D09960137483F5E572DC6822589C03E2D85C0EAF2B2DE4EDDAFE176886B5B38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC2FD.tmp\extracted\lua53-64.dll
- Size 528KB
- SHA256 6d0a06b90213f082cb98950890518c0f08b9fc16dbfab34d400267cb6cdadeff
- MD5 b7c9f1e7e640f1a034be84af86970d45
- SHA1 f795dc3d781b9578a96c92658b9f95806fc9bdde
- SHA512 da63992b68f1112c0d6b33e6004f38e85b3c3e251e0d5457cd63804a49c5aa05aa23249e0614dacad4fec28ca6efdb5ddee06da5bfbfa07e21942976201079f3
- SSDEEP 6144:FshVOadaiL9mUHQMpgL8LgpqClZNKX6SumisBEb/NUidzSky3uDMK/LXTMBQqN5T:hOL9J2L8E5VKKSuLGEhXGstCXoYkc7BV
- TLSH T1D0B47CA9A6781AB9FD3BD13AC8834917F7B234110B62DADF02E166750F137E2167B314
- MD5 SHA1 SHA512 SSDEEP TLSH