9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b

General

Target

9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe
Size

458KB
MD5

e623e316461a5179f70fe8ceba7d0ad4
SHA1

19d00d96b16822e1b76fa5ee890389b8a0238d6d
SHA256

9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b
SHA512

fc48297f187a33c6d1ac03ae8daa8c0fe55ac33dc46680c0f406bd8eef0046f4961ddcafd8c1ca208ffad4adfca37c6abdd6b40221594836c6016d0dd825fd5b
SSDEEP

12288:TUWA3AheuswyemhdS36N0eenbTdW8AgAXTp12gkM:TUWqiste9KDebT48AgqTp1f

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
736	svchost.exe
1372	csrss.exe

Loads dropped DLL 2 IoCs

pid	Process
2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe
2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
736	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	736	svchost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 736	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	28
PID 2028 wrote to memory of 736	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	28
PID 2028 wrote to memory of 736	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	28
PID 2028 wrote to memory of 736	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	28
PID 2028 wrote to memory of 736	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	28
PID 2028 wrote to memory of 736	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	28
PID 2028 wrote to memory of 736	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	28
PID 2028 wrote to memory of 1372	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	29
PID 2028 wrote to memory of 1372	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	29
PID 2028 wrote to memory of 1372	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	29
PID 2028 wrote to memory of 1372	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	29
PID 2028 wrote to memory of 1372	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	29
PID 2028 wrote to memory of 1372	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	29
PID 2028 wrote to memory of 1372	2028	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	29

C:\Users\Admin\AppData\Local\Temp\9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe
"C:\Users\Admin\AppData\Local\Temp\9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Common Files\Microsoft\svchost.exe
  "C:\Common Files\Microsoft\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:736
- C:\Common Files\Microsoft\csrss.exe
  "C:\Common Files\Microsoft\csrss.exe"
  2⤵
  - Executes dropped EXE
  PID:1372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Common Files\Microsoft\csrss.exe

Filesize
803KB

MD5
7a7fc6cd4fea870bb949140a9fea0cc2

SHA1
dcd3bcae577768946be983aa6137f703d798d780

SHA256
39a25e75a868a941f47e4bceac961f5d939ccb5dee44952d4f1f913ff45697a7

SHA512
dfeeb08e9aed003e3af315972fd73eab7305e0a3f41c77b08fd093aa8b0909f8303a37c6bd624071fc780752945b8dfeb2c075d302649c4e93ca81631a0aa61d

Download Submit
C:\Common Files\Microsoft\svchost.exe

Filesize
197KB

MD5
487382271e1d6fb8f817f3187741d5ad

SHA1
356a5b6ed799f98a0c4001ec673cac34fbe25a79

SHA256
717384f1ff3be86431f339abb298ccdce69a32129ef8ecf4840c69e19ceef72b

SHA512
0527819981e4753e2a7db269d4bab7f19523fd0e0585c7379a7971cf2243b2ebde770142760b129da5ab76ddf41d5b4c06d24c51355714e5f1e1d12635259fa7

Download Submit
C:\Common Files\Microsoft\svchost.exe

Filesize
197KB

MD5
487382271e1d6fb8f817f3187741d5ad

SHA1
356a5b6ed799f98a0c4001ec673cac34fbe25a79

SHA256
717384f1ff3be86431f339abb298ccdce69a32129ef8ecf4840c69e19ceef72b

SHA512
0527819981e4753e2a7db269d4bab7f19523fd0e0585c7379a7971cf2243b2ebde770142760b129da5ab76ddf41d5b4c06d24c51355714e5f1e1d12635259fa7

Download Submit
\Common Files\Microsoft\csrss.exe

Filesize
803KB

MD5
7a7fc6cd4fea870bb949140a9fea0cc2

SHA1
dcd3bcae577768946be983aa6137f703d798d780

SHA256
39a25e75a868a941f47e4bceac961f5d939ccb5dee44952d4f1f913ff45697a7

SHA512
dfeeb08e9aed003e3af315972fd73eab7305e0a3f41c77b08fd093aa8b0909f8303a37c6bd624071fc780752945b8dfeb2c075d302649c4e93ca81631a0aa61d

Download Submit
\Common Files\Microsoft\svchost.exe

Filesize
197KB

MD5
487382271e1d6fb8f817f3187741d5ad

SHA1
356a5b6ed799f98a0c4001ec673cac34fbe25a79

SHA256
717384f1ff3be86431f339abb298ccdce69a32129ef8ecf4840c69e19ceef72b

SHA512
0527819981e4753e2a7db269d4bab7f19523fd0e0585c7379a7971cf2243b2ebde770142760b129da5ab76ddf41d5b4c06d24c51355714e5f1e1d12635259fa7

Download Submit
memory/736-64-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/736-65-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/2028-54-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing