32d091a86c5a0323dd8d2ccc195427f8e798f88fae9bbb814fbbadcadfe26ba7

General

Target

af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe
Size

12.5MB
MD5

d412865db372ff51f4237c496025639b
SHA1

9cd5409d3ecf569b61beac788215ff3711c0f6fc
SHA256

af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc
SHA512

661532765f49d56ff41119217b29719837f9773c396ba6d9efa95d21dcfabd3d7c89c2e688b7da9b9a984d760bc505d980be3ba2ad14b1359423a891c34508b1
SSDEEP

393216:aqFZIAAa93h999999lvnMv+HmtFgWWgaxraJT4a:aPAN93h999999lMvmKgWKuTV

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

driver_setup.exe

pid process

3796 driver_setup.exe
Loads dropped DLL 1 IoCs

Processes:

MsiExec.exe

pid process

1804 MsiExec.exe

pid	process
3796	driver_setup.exe

pid	process
1804	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

driver_setup.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\H:	driver_setup.exe
File opened (read-only)	\??\K:	driver_setup.exe
File opened (read-only)	\??\M:	driver_setup.exe
File opened (read-only)	\??\G:	driver_setup.exe
File opened (read-only)	\??\T:	driver_setup.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	driver_setup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	driver_setup.exe
File opened (read-only)	\??\S:	driver_setup.exe
File opened (read-only)	\??\U:	driver_setup.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	driver_setup.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	driver_setup.exe
File opened (read-only)	\??\N:	driver_setup.exe
File opened (read-only)	\??\O:	driver_setup.exe
File opened (read-only)	\??\W:	driver_setup.exe
File opened (read-only)	\??\X:	driver_setup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	driver_setup.exe
File opened (read-only)	\??\I:	driver_setup.exe
File opened (read-only)	\??\P:	driver_setup.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	driver_setup.exe
File opened (read-only)	\??\L:	driver_setup.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	driver_setup.exe
File opened (read-only)	\??\V:	driver_setup.exe
File opened (read-only)	\??\Y:	driver_setup.exe
File opened (read-only)	\??\Y:	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e909c866916b25070000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e909c8660000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e909c866000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de909c866000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e909c86600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exedriver_setup.exe

description	pid	process
Token: SeSecurityPrivilege	3868	msiexec.exe
Token: SeCreateTokenPrivilege	3796	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	3796	driver_setup.exe
Token: SeLockMemoryPrivilege	3796	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	3796	driver_setup.exe
Token: SeMachineAccountPrivilege	3796	driver_setup.exe
Token: SeTcbPrivilege	3796	driver_setup.exe
Token: SeSecurityPrivilege	3796	driver_setup.exe
Token: SeTakeOwnershipPrivilege	3796	driver_setup.exe
Token: SeLoadDriverPrivilege	3796	driver_setup.exe
Token: SeSystemProfilePrivilege	3796	driver_setup.exe
Token: SeSystemtimePrivilege	3796	driver_setup.exe
Token: SeProfSingleProcessPrivilege	3796	driver_setup.exe
Token: SeIncBasePriorityPrivilege	3796	driver_setup.exe
Token: SeCreatePagefilePrivilege	3796	driver_setup.exe
Token: SeCreatePermanentPrivilege	3796	driver_setup.exe
Token: SeBackupPrivilege	3796	driver_setup.exe
Token: SeRestorePrivilege	3796	driver_setup.exe
Token: SeShutdownPrivilege	3796	driver_setup.exe
Token: SeDebugPrivilege	3796	driver_setup.exe
Token: SeAuditPrivilege	3796	driver_setup.exe
Token: SeSystemEnvironmentPrivilege	3796	driver_setup.exe
Token: SeChangeNotifyPrivilege	3796	driver_setup.exe
Token: SeRemoteShutdownPrivilege	3796	driver_setup.exe
Token: SeUndockPrivilege	3796	driver_setup.exe
Token: SeSyncAgentPrivilege	3796	driver_setup.exe
Token: SeEnableDelegationPrivilege	3796	driver_setup.exe
Token: SeManageVolumePrivilege	3796	driver_setup.exe
Token: SeImpersonatePrivilege	3796	driver_setup.exe
Token: SeCreateGlobalPrivilege	3796	driver_setup.exe
Token: SeShutdownPrivilege	3796	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	3796	driver_setup.exe
Token: SeCreateTokenPrivilege	3796	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	3796	driver_setup.exe
Token: SeLockMemoryPrivilege	3796	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	3796	driver_setup.exe
Token: SeMachineAccountPrivilege	3796	driver_setup.exe
Token: SeTcbPrivilege	3796	driver_setup.exe
Token: SeSecurityPrivilege	3796	driver_setup.exe
Token: SeTakeOwnershipPrivilege	3796	driver_setup.exe
Token: SeLoadDriverPrivilege	3796	driver_setup.exe
Token: SeSystemProfilePrivilege	3796	driver_setup.exe
Token: SeSystemtimePrivilege	3796	driver_setup.exe
Token: SeProfSingleProcessPrivilege	3796	driver_setup.exe
Token: SeIncBasePriorityPrivilege	3796	driver_setup.exe
Token: SeCreatePagefilePrivilege	3796	driver_setup.exe
Token: SeCreatePermanentPrivilege	3796	driver_setup.exe
Token: SeBackupPrivilege	3796	driver_setup.exe
Token: SeRestorePrivilege	3796	driver_setup.exe
Token: SeShutdownPrivilege	3796	driver_setup.exe
Token: SeDebugPrivilege	3796	driver_setup.exe
Token: SeAuditPrivilege	3796	driver_setup.exe
Token: SeSystemEnvironmentPrivilege	3796	driver_setup.exe
Token: SeChangeNotifyPrivilege	3796	driver_setup.exe
Token: SeRemoteShutdownPrivilege	3796	driver_setup.exe
Token: SeUndockPrivilege	3796	driver_setup.exe
Token: SeSyncAgentPrivilege	3796	driver_setup.exe
Token: SeEnableDelegationPrivilege	3796	driver_setup.exe
Token: SeManageVolumePrivilege	3796	driver_setup.exe
Token: SeImpersonatePrivilege	3796	driver_setup.exe
Token: SeCreateGlobalPrivilege	3796	driver_setup.exe
Token: SeCreateTokenPrivilege	3796	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	3796	driver_setup.exe
Token: SeLockMemoryPrivilege	3796	driver_setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

driver_setup.exe

pid process

3796 driver_setup.exe

pid	process
3796	driver_setup.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exemsiexec.exe

description	pid	process	target process
PID 516 wrote to memory of 3796	516	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe	driver_setup.exe
PID 516 wrote to memory of 3796	516	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe	driver_setup.exe
PID 3868 wrote to memory of 1804	3868	msiexec.exe	MsiExec.exe
PID 3868 wrote to memory of 1804	3868	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe
"C:\Users\Admin\AppData\Local\Temp\af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:516
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\driver_setup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\driver_setup.exe /i drvupdate-amd64.msi
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3796

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 082EE3DEDC33805F8245CB0B0A40500B C
  2⤵
  - Loads dropped DLL
  PID:1804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\driver_setup.exe

Filesize
59KB

MD5
1c9d8e8844535cd66165c26adcba2ca8

SHA1
79da07790f43325721f8c2ffa78b08693375c27b

SHA256
1e38c335d528fb87cfbb3b0aa5368a900a43d150b13b8bb6a20f5e95a65a2559

SHA512
589fb879b3467427c53b564abe074f0b404043002718b5c6959b0a8388a7153b432a3a24c14f0455e6bb53113409869ba9ab165739a20f68d85fab1a166d4ced

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\driver_setup.exe

Filesize
59KB

MD5
1c9d8e8844535cd66165c26adcba2ca8

SHA1
79da07790f43325721f8c2ffa78b08693375c27b

SHA256
1e38c335d528fb87cfbb3b0aa5368a900a43d150b13b8bb6a20f5e95a65a2559

SHA512
589fb879b3467427c53b564abe074f0b404043002718b5c6959b0a8388a7153b432a3a24c14f0455e6bb53113409869ba9ab165739a20f68d85fab1a166d4ced

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\drvupdate-amd64.msi

Filesize
13.4MB

MD5
f56b5dece86a36b21080ed1ad1f4ce61

SHA1
d767e43144125c32e8c1eb52010d0ceb8a839331

SHA256
adad5d14465e698d99b4468a1bb407544edc021b39a492c9c46f404289d1f03f

SHA512
76a06a4d9a564370501a41729f74fd4cad10a9db1990a41c0718b31dda2b2eb52abbe78a79fc0dade84b4d124e67a67132f89e5642b5fc6f3dbb0db9f6cd1a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA17B.tmp

Filesize
31KB

MD5
ce13966ea37e92259fff5e8527df24fc

SHA1
8f0e7f47ab6ffdf024392e20116a8ce638c80ef1

SHA256
70eab588fc2b8243114f392506a1ad34035b40948662709bd6d8310f68c1d06e

SHA512
b76a1e0e6a1484e1b0cbd5d0865e4df8cbc7c4c5b9913cf99f7f7a3164019585adbf187b711e0444db89331cc12fdc860a78e1025be9c287aebc34693fd26860

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA17B.tmp

Filesize
31KB

MD5
ce13966ea37e92259fff5e8527df24fc

SHA1
8f0e7f47ab6ffdf024392e20116a8ce638c80ef1

SHA256
70eab588fc2b8243114f392506a1ad34035b40948662709bd6d8310f68c1d06e

SHA512
b76a1e0e6a1484e1b0cbd5d0865e4df8cbc7c4c5b9913cf99f7f7a3164019585adbf187b711e0444db89331cc12fdc860a78e1025be9c287aebc34693fd26860

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads