33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
Size

321KB
MD5

6c2195b5306a954cb78543bc05244522
SHA1

50fe17cb809f3a4db15da5dfd3ec5c5f774a40cb
SHA256

33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14
SHA512

3de62a06e82b1d64fee9f5213f33d8c445525effd15e5e99df396a8f6577497da857d059827addcb49c8e8e49841b042c69bb6ab67f7fe913c3e96580f073ef6
SSDEEP

6144:5rPEy/nzKfxKDUFte7oLCFtahNhF5m0kGPC0pFFFVxf8vw42qDPnuXoeSwpC:5r1zKfBFc7ooohNhF3Pp/Ev5fuXohwE

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.exe	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
File opened for modification	C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.exe	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
Token: SeDebugPrivilege	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 368	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	4
PID 1888 wrote to memory of 368	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	4
PID 1888 wrote to memory of 368	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	4
PID 1888 wrote to memory of 368	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	4
PID 1888 wrote to memory of 368	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	4
PID 1888 wrote to memory of 368	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	4
PID 1888 wrote to memory of 368	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	4
PID 1888 wrote to memory of 384	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	3
PID 1888 wrote to memory of 384	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	3
PID 1888 wrote to memory of 384	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	3
PID 1888 wrote to memory of 384	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	3
PID 1888 wrote to memory of 384	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	3
PID 1888 wrote to memory of 384	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	3
PID 1888 wrote to memory of 384	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	3
PID 1888 wrote to memory of 420	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	2
PID 1888 wrote to memory of 420	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	2
PID 1888 wrote to memory of 420	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	2
PID 1888 wrote to memory of 420	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	2
PID 1888 wrote to memory of 420	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	2
PID 1888 wrote to memory of 420	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	2
PID 1888 wrote to memory of 420	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	2
PID 1888 wrote to memory of 464	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	1
PID 1888 wrote to memory of 464	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	1
PID 1888 wrote to memory of 464	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	1
PID 1888 wrote to memory of 464	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	1
PID 1888 wrote to memory of 464	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	1
PID 1888 wrote to memory of 464	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	1
PID 1888 wrote to memory of 464	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	1
PID 1888 wrote to memory of 480	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	5
PID 1888 wrote to memory of 480	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	5
PID 1888 wrote to memory of 480	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	5
PID 1888 wrote to memory of 480	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	5
PID 1888 wrote to memory of 480	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	5
PID 1888 wrote to memory of 480	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	5
PID 1888 wrote to memory of 480	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	5
PID 1888 wrote to memory of 488	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	27
PID 1888 wrote to memory of 488	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	27
PID 1888 wrote to memory of 488	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	27
PID 1888 wrote to memory of 488	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	27
PID 1888 wrote to memory of 488	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	27
PID 1888 wrote to memory of 488	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	27
PID 1888 wrote to memory of 488	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	27
PID 1888 wrote to memory of 596	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	26
PID 1888 wrote to memory of 596	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	26
PID 1888 wrote to memory of 596	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	26
PID 1888 wrote to memory of 596	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	26
PID 1888 wrote to memory of 596	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	26
PID 1888 wrote to memory of 596	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	26
PID 1888 wrote to memory of 596	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	26
PID 1888 wrote to memory of 672	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	25
PID 1888 wrote to memory of 672	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	25
PID 1888 wrote to memory of 672	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	25
PID 1888 wrote to memory of 672	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	25
PID 1888 wrote to memory of 672	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	25
PID 1888 wrote to memory of 672	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	25
PID 1888 wrote to memory of 672	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	25
PID 1888 wrote to memory of 756	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	24
PID 1888 wrote to memory of 756	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	24
PID 1888 wrote to memory of 756	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	24
PID 1888 wrote to memory of 756	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	24
PID 1888 wrote to memory of 756	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	24
PID 1888 wrote to memory of 756	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	24
PID 1888 wrote to memory of 756	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	24
PID 1888 wrote to memory of 820	1888	33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe	23

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1172
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1112
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1248
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1036
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:328
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:336
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:892
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:856
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:820
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:756
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:480
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:2036

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1972

C:\Users\Admin\AppData\Local\Temp\33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe
"C:\Users\Admin\AppData\Local\Temp\33443a4a98905dd356a7e59baa7e920dd6e1f9f25580c139fe4f5d488d8e6e14.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1372

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-54-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1888-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1888-56-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download