3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767 | Triage

Analysis

max time kernel
119s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
26-02-2022 10:24

Sharing

Report Analysis Logs

General

Target

3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
Size

114KB
MD5

decc2726599edcae8d1d1d0ca99d83a6
SHA1

0d8cc992f279ec45e8b8dfd05a700ff1f0437f29
SHA256

3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767
SHA512

1096ccabe0c99ab73bbc92c645814b6590f5a925801eb3a97e9930e3bc668738f8852e83628474836ba15983b6660eb5c2f2741e925d16877991ca89be47f49a

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\pvdr	3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
File opened for modification	C:\Windows\system32\Drivers\pvdr	3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
File created	C:\Windows\system32\Drivers\pvdr.sys	3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 0	552	3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
Token: SeBackupPrivilege	552	3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
Token: SeLoadDriverPrivilege	552	3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe

C:\Users\Admin\AppData\Local\Temp\3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
"C:\Users\Admin\AppData\Local\Temp\3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
PID:552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads