044c16cdbc6ec18f58bfecaacf4d4e21150a19d8d10c694c4a4c3085697499a2

Analysis

max time kernel
136s
max time network
143s
platform
windows7_x64
resource
win7v20201028
submitted
04-01-2021 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1476	DTEPlanoWS.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DTEPlanoWS.lnk	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe

Loads dropped DLL 13 IoCs

pid	Process
1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
1476	DTEPlanoWS.exe
1476	DTEPlanoWS.exe
1476	DTEPlanoWS.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DTEPlanoWS\ImprimirTicket.dll	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\WSClient.dll	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\SIIPLANO.dll	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\DTEUtils.dll	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\Util\Config.xml	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\SumatraPDF.exe	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\Update.exe	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\Util\Config_linux.xml	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\uninst.exe	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\sumatrapdfprefs.dat	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\DTEPlanoWS.exe.config	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\FTPClient.dll	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\BOLETA.xsd	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\DTEPlanoWS.exe	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File created	C:\Program Files (x86)\DTEPlanoWS\FacturacionCLPrint_App.jar	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
File opened for modification	C:\Program Files (x86)\DTEPlanoWS\DTEPlanoWS.url	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1476	DTEPlanoWS.exe
1476	DTEPlanoWS.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1476	DTEPlanoWS.exe
1476	DTEPlanoWS.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1476	1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe	26
PID 1864 wrote to memory of 1476	1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe	26
PID 1864 wrote to memory of 1476	1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe	26
PID 1864 wrote to memory of 1476	1864	b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe	26
PID 1476 wrote to memory of 1788	1476	DTEPlanoWS.exe	28
PID 1476 wrote to memory of 1788	1476	DTEPlanoWS.exe	28
PID 1476 wrote to memory of 1788	1476	DTEPlanoWS.exe	28
PID 1476 wrote to memory of 1788	1476	DTEPlanoWS.exe	28
PID 1788 wrote to memory of 1588	1788	csc.exe	30
PID 1788 wrote to memory of 1588	1788	csc.exe	30
PID 1788 wrote to memory of 1588	1788	csc.exe	30
PID 1788 wrote to memory of 1588	1788	csc.exe	30

C:\Users\Admin\AppData\Local\Temp\b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe
"C:\Users\Admin\AppData\Local\Temp\b6559bb03a3a150f020cd435a9d516d1b8b39b6abd34c66da6759e71bc7d9399.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\DTEPlanoWS\DTEPlanoWS.exe
  "C:\Program Files (x86)\DTEPlanoWS\DTEPlanoWS.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uyaezvik.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9741.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9731.tmp"
      4⤵
      PID:1588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads