bbf5829871a9c0e6348a4cbab3327df93fd5196b611afafef770cf85e85bfd6c

Analysis

max time kernel
143s
max time network
113s
platform
windows10_x64
resource
win10
submitted
10/08/2020, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
estado de cuenta.scr
Size 1.8MB
Sample200810-e294hpanje
SHA256 bbf5829871a9c0e6348a4cbab3327df93fd5196b611afafef770cf85e85bfd6c
MD5 17a8c036feac43b960a86cdf2395beaf
SHA1 1aa9f423260e4f803e7adf1a9ee7215459c2713f
SHA512 c1e8b17dddff59852788990e2e2baedfbbf2d241ee9e99e8c50cab6af4aff1b6f8b582389bd05502beccd3950d02d430c94ecc57a48b7464ea41db98d675a40d
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2476	win32.exe
2556	AddInProcess32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2476 set thread context of 2556	2476	win32.exe	77

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\win32 = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\win32.exe"	reg.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	estado de cuenta.scr
Token: SeDebugPrivilege	2476	win32.exe
Token: SeDebugPrivilege	4088	powershell.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3148	estado de cuenta.scr
3148	estado de cuenta.scr
3148	estado de cuenta.scr
3148	estado de cuenta.scr
3148	estado de cuenta.scr
3148	estado de cuenta.scr
3148	estado de cuenta.scr
3148	estado de cuenta.scr
3148	estado de cuenta.scr
3148	estado de cuenta.scr
3148	estado de cuenta.scr
3148	estado de cuenta.scr
3148	estado de cuenta.scr
3148	estado de cuenta.scr
2476	win32.exe
2476	win32.exe
2476	win32.exe
4088	powershell.exe
4088	powershell.exe
4088	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 3444	3148	estado de cuenta.scr	67
PID 3148 wrote to memory of 3444	3148	estado de cuenta.scr	67
PID 3148 wrote to memory of 3444	3148	estado de cuenta.scr	67
PID 3444 wrote to memory of 1844	3444	cmd.exe	69
PID 3444 wrote to memory of 1844	3444	cmd.exe	69
PID 3444 wrote to memory of 1844	3444	cmd.exe	69
PID 3148 wrote to memory of 2476	3148	estado de cuenta.scr	70
PID 3148 wrote to memory of 2476	3148	estado de cuenta.scr	70
PID 3148 wrote to memory of 2476	3148	estado de cuenta.scr	70
PID 2476 wrote to memory of 2556	2476	win32.exe	77
PID 2476 wrote to memory of 2556	2476	win32.exe	77
PID 2476 wrote to memory of 2556	2476	win32.exe	77
PID 2476 wrote to memory of 2556	2476	win32.exe	77
PID 2476 wrote to memory of 2556	2476	win32.exe	77
PID 2476 wrote to memory of 2556	2476	win32.exe	77
PID 2476 wrote to memory of 2556	2476	win32.exe	77
PID 2476 wrote to memory of 2556	2476	win32.exe	77
PID 2556 wrote to memory of 2996	2556	AddInProcess32.exe	79
PID 2556 wrote to memory of 2996	2556	AddInProcess32.exe	79
PID 2556 wrote to memory of 2996	2556	AddInProcess32.exe	79
PID 2996 wrote to memory of 4088	2996	cmd.exe	81
PID 2996 wrote to memory of 4088	2996	cmd.exe	81
PID 2996 wrote to memory of 4088	2996	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\estado de cuenta.scr
"C:\Users\Admin\AppData\Local\Temp\estado de cuenta.scr" /S
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v win32 /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\win32.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v win32 /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\win32.exe"
    3⤵
    - Adds Run key to start application
    PID:1844
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\win32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\win32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
    "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2996
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: EnumeratesProcesses
        
        PID:4088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-17-0x0000000005580000-0x0000000005583000-memory.dmp

Download

memory/2476-11-0x0000000072EF0000-0x00000000735DE000-memory.dmp

Download

memory/2556-27-0x0000000005490000-0x0000000005501000-memory.dmp

Download

memory/2556-18-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/2556-22-0x0000000072EF0000-0x00000000735DE000-memory.dmp

Download

memory/2556-26-0x0000000005380000-0x0000000005381000-memory.dmp

Download

memory/2556-28-0x0000000005580000-0x0000000005581000-memory.dmp

Download

memory/3148-5-0x00000000057E0000-0x00000000057E1000-memory.dmp

Download

memory/3148-4-0x0000000005C00000-0x0000000005C01000-memory.dmp

Download

memory/3148-3-0x0000000004F20000-0x0000000004F2F000-memory.dmp

Download

memory/3148-1-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/3148-0-0x0000000072EF0000-0x00000000735DE000-memory.dmp

Download

memory/4088-33-0x0000000072EF0000-0x00000000735DE000-memory.dmp

Download

memory/4088-34-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Download

memory/4088-35-0x0000000006D00000-0x0000000006D01000-memory.dmp

Download

memory/4088-36-0x0000000006BD0000-0x0000000006BD1000-memory.dmp

Download

memory/4088-37-0x0000000006C70000-0x0000000006C71000-memory.dmp

Download

memory/4088-39-0x0000000007640000-0x0000000007641000-memory.dmp

Download

memory/4088-40-0x0000000007460000-0x0000000007461000-memory.dmp

Download

memory/4088-41-0x0000000007C70000-0x0000000007C71000-memory.dmp

Download

memory/4088-42-0x0000000007CC0000-0x0000000007CC1000-memory.dmp

Download

memory/4088-43-0x00000000093E0000-0x00000000093E1000-memory.dmp

Download

memory/4088-44-0x0000000008990000-0x0000000008991000-memory.dmp

Download

memory/4088-45-0x0000000008D60000-0x0000000008D61000-memory.dmp

Download

memory/4088-46-0x0000000006810000-0x0000000006811000-memory.dmp

Download