fbe0c5aab0d98f9b21b4a71dee73f37df653919ad7490966f5180eaf968780ae

General

Target
1D51F73C1070464F54A0AF686B38ECD1.exe
Size 1.7MB
Sample210618-pvrhvrlyfa
SHA256 fbe0c5aab0d98f9b21b4a71dee73f37df653919ad7490966f5180eaf968780ae
MD5 1d51f73c1070464f54a0af686b38ecd1
SHA1 2c364a153831573ca5b18ce38f874969a07f06a6
SHA512 36130687d3068ebd1084d88e228dfc815b2b322a3f58b95ef63430977e053b81875919322c9c18246afefa676fab554943081078d80948d21d0f026d3a7dd0e2
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2012	savedlldrivers.sfx.exe
1808	savedlldrivers.exe

Loads dropped DLL 7 IoCs

pid	Process
1084	1D51F73C1070464F54A0AF686B38ECD1.exe
1084	1D51F73C1070464F54A0AF686B38ECD1.exe
1084	1D51F73C1070464F54A0AF686B38ECD1.exe
2012	savedlldrivers.sfx.exe
2012	savedlldrivers.sfx.exe
2012	savedlldrivers.sfx.exe
2012	savedlldrivers.sfx.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1808	savedlldrivers.exe
1808	savedlldrivers.exe
1808	savedlldrivers.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
612	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	savedlldrivers.exe
Token: SeDebugPrivilege	612	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1808	savedlldrivers.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2012	1084	1D51F73C1070464F54A0AF686B38ECD1.exe	26
PID 1084 wrote to memory of 2012	1084	1D51F73C1070464F54A0AF686B38ECD1.exe	26
PID 1084 wrote to memory of 2012	1084	1D51F73C1070464F54A0AF686B38ECD1.exe	26
PID 1084 wrote to memory of 2012	1084	1D51F73C1070464F54A0AF686B38ECD1.exe	26
PID 2012 wrote to memory of 1808	2012	savedlldrivers.sfx.exe	27
PID 2012 wrote to memory of 1808	2012	savedlldrivers.sfx.exe	27
PID 2012 wrote to memory of 1808	2012	savedlldrivers.sfx.exe	27
PID 2012 wrote to memory of 1808	2012	savedlldrivers.sfx.exe	27
PID 1808 wrote to memory of 800	1808	savedlldrivers.exe	31
PID 1808 wrote to memory of 800	1808	savedlldrivers.exe	31
PID 1808 wrote to memory of 800	1808	savedlldrivers.exe	31
PID 1808 wrote to memory of 800	1808	savedlldrivers.exe	31
PID 800 wrote to memory of 612	800	cmd.exe	33
PID 800 wrote to memory of 612	800	cmd.exe	33
PID 800 wrote to memory of 612	800	cmd.exe	33
PID 800 wrote to memory of 612	800	cmd.exe	33
PID 800 wrote to memory of 1556	800	cmd.exe	35
PID 800 wrote to memory of 1556	800	cmd.exe	35
PID 800 wrote to memory of 1556	800	cmd.exe	35
PID 800 wrote to memory of 1556	800	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\1D51F73C1070464F54A0AF686B38ECD1.exe
"C:\Users\Admin\AppData\Local\Temp\1D51F73C1070464F54A0AF686B38ECD1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\savedlldrivers.sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\savedlldrivers.sfx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\savedlldrivers.exe
    "C:\Users\Admin\AppData\Local\Temp\savedlldrivers.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C taskkill /F /PID 1808 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\savedlldrivers.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /PID 1808
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:612
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-59-0x0000000075561000-0x0000000075563000-memory.dmp

Download

memory/1808-77-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/1808-75-0x0000000000060000-0x0000000000061000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads