PCHunter64

Execution T1106 Native API Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

T1574.010 Services File Permissions Weakness ... Adversaries may execute their own malicious payloads by hijacking the binaries used by services.

T1112 Modify Registry Adversaries may interact with the Windows Registry ...

T1543 Create or Modify System Process ... Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.

"PCHunter64.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PCHUNTER64") ... Key: "IMAGEPATH"; Value: "C:\PCHunter64.sys"

T1547.006 Kernel Modules and Extensions ... Adversaries may modify the kernel to automatically execute programs on system boot.

T1547.008 LSASS Driver Persistence Privilege Escalation Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

T1055.012 Process Hollowing ... Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses.

T1055.013 Process Doppelg��nging ... Adversaries may inject malicious code into process via process doppelg��nging

Contains ability to enable or disable privileges in the specified access token (API string) details Observed api string:"AdjustTokenPrivileges" ... ATT&CK ID T1134

T1134.001 Token Impersonation/Theft ... Adversaries may duplicate then impersonate another user's token ...

T1543 Create or Modify System Process ... Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.

"PCHunter64.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PCHUNTER64") ... Key: "IMAGEPATH"; Value: "C:\PCHunter64.sys"

T1547.006 Kernel Modules and Extensions ... Adversaries may modify the kernel to automatically execute programs on system boot.

T1547.008 LSASS Driver Persistence Privilege Escalation Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

Contains ability to use security policy setting (API string) details Observed api string:"SeDebugPrivilege ..." ... ATT&CK ID T1548

Anti-Detection/Stealthyness PE file contains executable resources ... source Static Parser relevance 10/10 ATT&CK ID T1027

PE file has a section name known to be used by a packer/protector PE file is protected by VMProtect ... ATT&CK ID T1027.002

T1055.012 Process Hollowing ... Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses.

T1055.013 Process Doppelg��nging ... Adversaries may inject malicious code into process via process doppelg��nging

"PCHunter64.exe" marked "C:\PCHunter64as.sys" for deletion ... ATT&CK ID T1070.004

Contains ability to enable or disable privileges in the specified access token (API string) details Observed api string:"AdjustTokenPrivileges" ... ATT&CK ID T1134

T1134.001 Token Impersonation/Theft ... Adversaries may duplicate then impersonate another user's token ...

T1497 Virtualization/Sandbox Evasion ... Possibly tries to implement anti-virtualization techniques ... The input sample contains a known anti-VM trick

T1574.010 Services File Permissions Weakness ... Adversaries may execute their own malicious payloads by hijacking the binaries used by services.

Queries kernel debugger information ... Possibly checks for the presence of a forensics/monitoring tool ... ATT&CK ID T1622

T1112 Modify Registry Adversaries may interact with the Windows Registry ...

The input sample is signed with a certificate ... ATT&CK ID T1553.002

Credential Access T1056.001 Keylogging ... Adversaries may log user keystrokes to intercept credentials

Installs hooks/patches the running process ... wrote bytes ... part of module "WININET.DLL" ... ATT&CK ID T1056.004

T1010 Application Window Discovery Adversaries may attempt to get a listing of open application windows.

Queries sensitive IE security settings ... Queries the internet cache settings ... ATT&CK ID T1012

T1016 System Network Configuration Discovery ... Adversaries may look for details about the network configuration and settings

T1057 Process Discovery Adversaries may attempt to get information about running processes on a system.

T1082 System Information Discovery ... get detailed information about the operating system and hardware

Discovery T1083 File and Directory Discovery ... Adversaries may enumerate files and directories

Observed import api "NetUserEnum" which can "Retrieves information about all user accounts on a server." ... ATT&CK ID T1087.001

T1497 Virtualization/Sandbox Evasion ... Possibly tries to implement anti-virtualization techniques ... The input sample contains a known anti-VM trick

T1518.001 Security Software Discovery ... References security related windows services

Reads information about supported languages details "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE" ... ATT&CK ID T1012

Queries kernel debugger information ... Possibly checks for the presence of a forensics/monitoring tool ... ATT&CK ID T1622

Credential Access T1056.001 Keylogging ... Adversaries may log user keystrokes to intercept credentials

Installs hooks/patches the running process ... wrote bytes ... part of module "WININET.DLL" ... ATT&CK ID T1056.004

Collection T1113 Screen Capture Adversaries may attempt to take screen captures of the desktop

Collection T1114 Email Collection Adversaries may target user email to collect sensitive information.

Command and Control T1071 Application Layer Protocol ... Calls an API typically used to create a new HTTP request

GETs files from a webserver details "GET /pchunter/pchunter_free HTTP/1.1 ... Host: www.epoolsoft.com"

Command and Control ... T1071.004 DNS ... Queries DNS server

Drops executable files ... ATT&CK ID T1105

T1573 Encrypted Channel Adversaries may employ a known encryption algorithm to conceal command and control traffic

Impact T1486 Data Encrypted for Impact Adversaries may encrypt data on target systems

Deletes safeboot related registry keys ... source Registry Access relevance 8/10 ATT&CK ID T1562.009