33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee

Analysis

max time kernel
169s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe
Size

281KB
MD5

6476bc510af26fc8e510b344acf78ae0
SHA1

e35428f3d1821467706cd0e9a5bb10f4c45a911a
SHA256

33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee
SHA512

c3be6017e780aad1f28fbad2c6056375034386a77cdeffe8c07bad3177922b44806ae5ba5a3747d0dff938b2d6073ef383ba1c65479406293cef75deb338a797
SSDEEP

6144:NSFUXrX1/anbtZks06vhodqYrDDwuB4YGylfa/YK1wot31:NOUj1/ass0Cc8pvylfUpF

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2308	ssssssss.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	ssssssss.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2308	4984	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe	82
PID 4984 wrote to memory of 2308	4984	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe	82
PID 4984 wrote to memory of 2308	4984	33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe	82

C:\Users\Admin\AppData\Local\Temp\33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe
"C:\Users\Admin\AppData\Local\Temp\33db501f3ed9562fe40cf7b507d2fd2e0167832a9d57f124fd159fc25d2abcee.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\ssssssss.exe
  "C:\Users\Admin\AppData\Local\Temp\ssssssss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ssssssss.exe

Filesize
193KB

MD5
52c9b7cf8d53cece0af6781777d1d17b

SHA1
c32674a86537c5094d2552650aecf0c370a21975

SHA256
f276ef96119f4217a000771fc3e947a8fb816390481b1218c4097d72eb7fab9b

SHA512
01879e1d1e8ce65f97b70af84c468fafd7a322277bc5129cbaa20c64ba30cdd607c46619cfa86867d4adbb66dd12e6688e56bd2e4ca9f96c21d72a06a6096684

Download Submit
C:\Users\Admin\AppData\Local\Temp\ssssssss.exe

Filesize
193KB

MD5
52c9b7cf8d53cece0af6781777d1d17b

SHA1
c32674a86537c5094d2552650aecf0c370a21975

SHA256
f276ef96119f4217a000771fc3e947a8fb816390481b1218c4097d72eb7fab9b

SHA512
01879e1d1e8ce65f97b70af84c468fafd7a322277bc5129cbaa20c64ba30cdd607c46619cfa86867d4adbb66dd12e6688e56bd2e4ca9f96c21d72a06a6096684

Download Submit
memory/2308-135-0x0000000000510000-0x000000000052E000-memory.dmp

Filesize
120KB

Download
memory/2308-138-0x00000000730C0000-0x0000000073671000-memory.dmp

Filesize
5.7MB

Download
memory/2308-139-0x0000000000510000-0x000000000052E000-memory.dmp

Filesize
120KB

Download
memory/2308-140-0x0000000000510000-0x000000000052E000-memory.dmp

Filesize
120KB

Download
memory/2308-141-0x0000000000510000-0x000000000052E000-memory.dmp

Filesize
120KB

Download
memory/2308-142-0x0000000000510000-0x000000000052E000-memory.dmp

Filesize
120KB

Download
memory/2308-143-0x00000000730C0000-0x0000000073671000-memory.dmp

Filesize
5.7MB

Download
memory/2308-144-0x00000000730C0000-0x0000000073671000-memory.dmp

Filesize
5.7MB

Download