fbe0c5aab0d98f9b21b4a71dee73f37df653919ad7490966f5180eaf968780ae

General

Target
1D51F73C1070464F54A0AF686B38ECD1.exe
Size 1.7MB
Sample210618-pvrhvrlyfa
SHA256 fbe0c5aab0d98f9b21b4a71dee73f37df653919ad7490966f5180eaf968780ae
MD5 1d51f73c1070464f54a0af686b38ecd1
SHA1 2c364a153831573ca5b18ce38f874969a07f06a6
SHA512 36130687d3068ebd1084d88e228dfc815b2b322a3f58b95ef63430977e053b81875919322c9c18246afefa676fab554943081078d80948d21d0f026d3a7dd0e2
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3732	savedlldrivers.sfx.exe
1244	savedlldrivers.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1244	savedlldrivers.exe
1244	savedlldrivers.exe
1244	savedlldrivers.exe
1244	savedlldrivers.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2324	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	savedlldrivers.exe
Token: SeDebugPrivilege	2324	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1244	savedlldrivers.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 3732	860	1D51F73C1070464F54A0AF686B38ECD1.exe	75
PID 860 wrote to memory of 3732	860	1D51F73C1070464F54A0AF686B38ECD1.exe	75
PID 860 wrote to memory of 3732	860	1D51F73C1070464F54A0AF686B38ECD1.exe	75
PID 3732 wrote to memory of 1244	3732	savedlldrivers.sfx.exe	77
PID 3732 wrote to memory of 1244	3732	savedlldrivers.sfx.exe	77
PID 3732 wrote to memory of 1244	3732	savedlldrivers.sfx.exe	77
PID 1244 wrote to memory of 2084	1244	savedlldrivers.exe	81
PID 1244 wrote to memory of 2084	1244	savedlldrivers.exe	81
PID 1244 wrote to memory of 2084	1244	savedlldrivers.exe	81
PID 2084 wrote to memory of 2324	2084	cmd.exe	83
PID 2084 wrote to memory of 2324	2084	cmd.exe	83
PID 2084 wrote to memory of 2324	2084	cmd.exe	83
PID 2084 wrote to memory of 1804	2084	cmd.exe	85
PID 2084 wrote to memory of 1804	2084	cmd.exe	85
PID 2084 wrote to memory of 1804	2084	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\1D51F73C1070464F54A0AF686B38ECD1.exe
"C:\Users\Admin\AppData\Local\Temp\1D51F73C1070464F54A0AF686B38ECD1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\savedlldrivers.sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\savedlldrivers.sfx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Users\Admin\AppData\Local\Temp\savedlldrivers.exe
    "C:\Users\Admin\AppData\Local\Temp\savedlldrivers.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C taskkill /F /PID 1244 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\savedlldrivers.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2084
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /PID 1244
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:1804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-127-0x0000000005970000-0x0000000005971000-memory.dmp

Download

memory/1244-124-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/1244-126-0x0000000005F60000-0x0000000005F61000-memory.dmp

Download

memory/1244-128-0x00000000059D0000-0x00000000059D1000-memory.dmp

Download

memory/1244-129-0x0000000005A10000-0x0000000005A11000-memory.dmp

Download

memory/1244-130-0x0000000005940000-0x0000000005941000-memory.dmp

Download

memory/1244-131-0x0000000005C70000-0x0000000005C71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads