993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522

General

Target

993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe
Size

394KB
MD5

4c6b88b2c0c75bf38d88826995a4204c
SHA1

08b3ade2efba22b5c758f42197dd642ae48138a9
SHA256

993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522
SHA512

8886ddeab05a97e1fa3f39b8132b9bb759a745d11d961f6c16497095861bc841a8ffa06db029158eccf74447eef0880e8ad30e0584d14e3cfb91c24380b099a6
SSDEEP

6144:DCm3gJX5z2ODOUlSZF64zfINQIVK7gAtqGIaH+5UpWPgPta/qe9xvAZZC/fREKGO:DeZ9/Tp2QfK7XfH+5zPgV3s6Zo5EK2G

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4120 set thread context of 5080	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	84

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1824	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5080	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe
Token: SeDebugPrivilege	5080	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4940	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	81
PID 4120 wrote to memory of 4940	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	81
PID 4120 wrote to memory of 4940	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	81
PID 4940 wrote to memory of 1824	4940	cmd.exe	83
PID 4940 wrote to memory of 1824	4940	cmd.exe	83
PID 4940 wrote to memory of 1824	4940	cmd.exe	83
PID 4120 wrote to memory of 5080	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	84
PID 4120 wrote to memory of 5080	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	84
PID 4120 wrote to memory of 5080	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	84
PID 4120 wrote to memory of 5080	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	84
PID 4120 wrote to memory of 5080	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	84
PID 4120 wrote to memory of 5080	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	84
PID 4120 wrote to memory of 5080	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	84
PID 4120 wrote to memory of 5080	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	84
PID 4120 wrote to memory of 5080	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	84
PID 4120 wrote to memory of 5080	4120	993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe	84

C:\Users\Admin\AppData\Local\Temp\993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe
"C:\Users\Admin\AppData\Local\Temp\993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PING 127.0.0.1 -n 10 > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 10
    3⤵
    - Runs ping.exe
    PID:1824
- C:\Users\Admin\AppData\Local\Temp\993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe
  "C:\Users\Admin\AppData\Local\Temp\993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\993f3ca57197b1a47adf464f599625fd65b1ec06d08887160aebfafa27ac8522.exe.log

Filesize
400B

MD5
0a9b4592cd49c3c21f6767c2dabda92f

SHA1
f534297527ae5ccc0ecb2221ddeb8e58daeb8b74

SHA256
c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd

SHA512
6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

Download Submit
memory/4120-138-0x0000000074E50000-0x0000000075401000-memory.dmp

Filesize
5.7MB

Download
memory/4120-166-0x0000000074E50000-0x0000000075401000-memory.dmp

Filesize
5.7MB

Download
memory/4120-135-0x0000000074E50000-0x0000000075401000-memory.dmp

Filesize
5.7MB

Download
memory/5080-148-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-152-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-144-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-145-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-146-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-147-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-140-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-150-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-149-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-143-0x0000000074E50000-0x0000000075401000-memory.dmp

Filesize
5.7MB

Download
memory/5080-153-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-155-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-157-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-158-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-161-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-162-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-164-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5080-165-0x0000000074E50000-0x0000000075401000-memory.dmp

Filesize
5.7MB

Download
memory/5080-167-0x0000000074E50000-0x0000000075401000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing