33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee

General

Target

33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe
Size

281KB
MD5

6476bc510af26fc8e510b344acf78ae0
SHA1

e35428f3d1821467706cd0e9a5bb10f4c45a911a
SHA256

33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee
SHA512

c3be6017e780aad1f28fbad2c6056375034386a77cdeffe8c07bad3177922b44806ae5ba5a3747d0dff938b2d6073ef383ba1c65479406293cef75deb338a797
SSDEEP

6144:NSFUXrX1/anbtZks06vhodqYrDDwuB4YGylfa/YK1wot31:NOUj1/ass0Cc8pvylfUpF

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1740	ssssssss.exe

Loads dropped DLL 5 IoCs

pid	Process
1780	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe
1780	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe
1780	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe
1780	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe
1780	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	ssssssss.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1740	1780	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe	28
PID 1780 wrote to memory of 1740	1780	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe	28
PID 1780 wrote to memory of 1740	1780	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe	28
PID 1780 wrote to memory of 1740	1780	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe	28
PID 1780 wrote to memory of 1740	1780	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe	28
PID 1780 wrote to memory of 1740	1780	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe	28
PID 1780 wrote to memory of 1740	1780	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe	28

C:\Users\Admin\AppData\Local\Temp\33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe
"C:\Users\Admin\AppData\Local\Temp\33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\ssssssss.exe
  "C:\Users\Admin\AppData\Local\Temp\ssssssss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ssssssss.exe

Filesize
193KB

MD5
52c9b7cf8d53cece0af6781777d1d17b

SHA1
c32674a86537c5094d2552650aecf0c370a21975

SHA256
f276ef96119f4217a000771fc3e947a8fb816390481b1218c4097d72eb7fab9b

SHA512
01879e1d1e8ce65f97b70af84c468fafd7a322277bc5129cbaa20c64ba30cdd607c46619cfa86867d4adbb66dd12e6688e56bd2e4ca9f96c21d72a06a6096684

Download Submit
\Users\Admin\AppData\Local\Temp\ssssssss.exe

Filesize
193KB

MD5
52c9b7cf8d53cece0af6781777d1d17b

SHA1
c32674a86537c5094d2552650aecf0c370a21975

SHA256
f276ef96119f4217a000771fc3e947a8fb816390481b1218c4097d72eb7fab9b

SHA512
01879e1d1e8ce65f97b70af84c468fafd7a322277bc5129cbaa20c64ba30cdd607c46619cfa86867d4adbb66dd12e6688e56bd2e4ca9f96c21d72a06a6096684

Download Submit
\Users\Admin\AppData\Local\Temp\ssssssss.exe

Filesize
193KB

MD5
52c9b7cf8d53cece0af6781777d1d17b

SHA1
c32674a86537c5094d2552650aecf0c370a21975

SHA256
f276ef96119f4217a000771fc3e947a8fb816390481b1218c4097d72eb7fab9b

SHA512
01879e1d1e8ce65f97b70af84c468fafd7a322277bc5129cbaa20c64ba30cdd607c46619cfa86867d4adbb66dd12e6688e56bd2e4ca9f96c21d72a06a6096684

Download Submit
\Users\Admin\AppData\Local\Temp\ssssssss.exe

Filesize
193KB

MD5
52c9b7cf8d53cece0af6781777d1d17b

SHA1
c32674a86537c5094d2552650aecf0c370a21975

SHA256
f276ef96119f4217a000771fc3e947a8fb816390481b1218c4097d72eb7fab9b

SHA512
01879e1d1e8ce65f97b70af84c468fafd7a322277bc5129cbaa20c64ba30cdd607c46619cfa86867d4adbb66dd12e6688e56bd2e4ca9f96c21d72a06a6096684

Download Submit
\Users\Admin\AppData\Local\Temp\ssssssss.exe

Filesize
193KB

MD5
52c9b7cf8d53cece0af6781777d1d17b

SHA1
c32674a86537c5094d2552650aecf0c370a21975

SHA256
f276ef96119f4217a000771fc3e947a8fb816390481b1218c4097d72eb7fab9b

SHA512
01879e1d1e8ce65f97b70af84c468fafd7a322277bc5129cbaa20c64ba30cdd607c46619cfa86867d4adbb66dd12e6688e56bd2e4ca9f96c21d72a06a6096684

Download Submit
\Users\Admin\AppData\Local\Temp\ssssssss.exe

Filesize
193KB

MD5
52c9b7cf8d53cece0af6781777d1d17b

SHA1
c32674a86537c5094d2552650aecf0c370a21975

SHA256
f276ef96119f4217a000771fc3e947a8fb816390481b1218c4097d72eb7fab9b

SHA512
01879e1d1e8ce65f97b70af84c468fafd7a322277bc5129cbaa20c64ba30cdd607c46619cfa86867d4adbb66dd12e6688e56bd2e4ca9f96c21d72a06a6096684

Download Submit
memory/1740-63-0x0000000000230000-0x000000000024E000-memory.dmp

Filesize
120KB

Download
memory/1740-66-0x0000000000230000-0x000000000024E000-memory.dmp

Filesize
120KB

Download
memory/1740-67-0x0000000000230000-0x000000000024E000-memory.dmp

Filesize
120KB

Download
memory/1740-68-0x0000000000230000-0x000000000024E000-memory.dmp

Filesize
120KB

Download
memory/1740-69-0x0000000000230000-0x000000000024E000-memory.dmp

Filesize
120KB

Download
memory/1740-70-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/1740-71-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/1780-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing