232cd6e3a8157124fc7c6f627ad603f2b2916a31895f37a5ab491afc4831a0a3

General

Target

PANTALLA DE PAGO 22.12.2020.js
Size

4.3MB
MD5

7fa3bfaf2100b802393679e3ddcc7f14
SHA1

82ed0bbe14af2f0b1510f49029e7733d7cae49a5
SHA256

232cd6e3a8157124fc7c6f627ad603f2b2916a31895f37a5ab491afc4831a0a3
SHA512

01f3d40d00bf99f8a8beb2acefba03717fcb5ae108ef7973253b83b9f41206704ff211aeb2f6dfc75549b775beae6811a27edd5c6a6e3bb36589d1f6fc6c817d

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

iihCqEKxqpsYel.exeVJAOLB.exeVJAOLB.exe

pid process

1400 iihCqEKxqpsYel.exe
1360 VJAOLB.exe
1448 VJAOLB.exe

pid	process
1400	iihCqEKxqpsYel.exe
1360	VJAOLB.exe
1448	VJAOLB.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\iihCqEKxqpsYel.exe	upx
C:\Users\Admin\AppData\Local\Temp\iihCqEKxqpsYel.exe	upx
C:\Users\Admin\AppData\Roaming\Windata\VJAOLB.exe	upx
C:\Users\Admin\AppData\Roaming\Windata\VJAOLB.exe	upx
C:\Users\Admin\AppData\Roaming\Windata\VJAOLB.exe	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iihCqEKxqpsYel.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run	iihCqEKxqpsYel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ALWBEE = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\VJAOLB.exe\""	iihCqEKxqpsYel.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

520 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

iihCqEKxqpsYel.exe

pid process

1400 iihCqEKxqpsYel.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iihCqEKxqpsYel.exe

pid process

1400 iihCqEKxqpsYel.exe

pid	process
520	schtasks.exe

pid	process
1400	iihCqEKxqpsYel.exe

pid	process
1400	iihCqEKxqpsYel.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

wscript.exeiihCqEKxqpsYel.execmd.exetaskeng.exe

description	pid	process	target process
PID 476 wrote to memory of 1400	476	wscript.exe	iihCqEKxqpsYel.exe
PID 476 wrote to memory of 1400	476	wscript.exe	iihCqEKxqpsYel.exe
PID 476 wrote to memory of 1400	476	wscript.exe	iihCqEKxqpsYel.exe
PID 476 wrote to memory of 1400	476	wscript.exe	iihCqEKxqpsYel.exe
PID 1400 wrote to memory of 1692	1400	iihCqEKxqpsYel.exe	cmd.exe
PID 1400 wrote to memory of 1692	1400	iihCqEKxqpsYel.exe	cmd.exe
PID 1400 wrote to memory of 1692	1400	iihCqEKxqpsYel.exe	cmd.exe
PID 1400 wrote to memory of 1692	1400	iihCqEKxqpsYel.exe	cmd.exe
PID 1692 wrote to memory of 520	1692	cmd.exe	schtasks.exe
PID 1692 wrote to memory of 520	1692	cmd.exe	schtasks.exe
PID 1692 wrote to memory of 520	1692	cmd.exe	schtasks.exe
PID 1692 wrote to memory of 520	1692	cmd.exe	schtasks.exe
PID 812 wrote to memory of 1360	812	taskeng.exe	VJAOLB.exe
PID 812 wrote to memory of 1360	812	taskeng.exe	VJAOLB.exe
PID 812 wrote to memory of 1360	812	taskeng.exe	VJAOLB.exe
PID 812 wrote to memory of 1360	812	taskeng.exe	VJAOLB.exe
PID 812 wrote to memory of 1448	812	taskeng.exe	VJAOLB.exe
PID 812 wrote to memory of 1448	812	taskeng.exe	VJAOLB.exe
PID 812 wrote to memory of 1448	812	taskeng.exe	VJAOLB.exe
PID 812 wrote to memory of 1448	812	taskeng.exe	VJAOLB.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PANTALLA DE PAGO 22.12.2020.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:476

C:\Users\Admin\AppData\Local\Temp\iihCqEKxqpsYel.exe
"C:\Users\Admin\AppData\Local\Temp\iihCqEKxqpsYel.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /create /tn ALWBEE.exe /tr C:\Users\Admin\AppData\Roaming\Windata\VJAOLB.exe /sc minute /mo 1
3⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn ALWBEE.exe /tr C:\Users\Admin\AppData\Roaming\Windata\VJAOLB.exe /sc minute /mo 1
4⤵
- Creates scheduled task(s)
PID:520

C:\Windows\system32\taskeng.exe
taskeng.exe {AAA30383-D4BE-4AB5-9108-5B236ABEBCAF} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:812

C:\Users\Admin\AppData\Roaming\Windata\VJAOLB.exe
C:\Users\Admin\AppData\Roaming\Windata\VJAOLB.exe
2⤵
- Executes dropped EXE
PID:1360

C:\Users\Admin\AppData\Roaming\Windata\VJAOLB.exe
C:\Users\Admin\AppData\Roaming\Windata\VJAOLB.exe
2⤵
- Executes dropped EXE
PID:1448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\iihCqEKxqpsYel.exe
MD5
3814443d1a0625d8d3ebdd4bc5fb410a

SHA1
fcd7812a24b11e070e4974dd360089764c0555b8

SHA256
12c7cc1d8bae77c0f4b4ab27c2f6fca4b795245988eab91cb4ca00158626cfb5

SHA512
a41af9ca01e022516ae59ac4c898aa6c7e36c4b43d16498b46fd628bcda1f7680e8344d6b8e03e538da79bda241b3b9fe8b0fa3cc501754514be1b1c93cdd346

Download Submit
C:\Users\Admin\AppData\Local\Temp\iihCqEKxqpsYel.exe
MD5
3814443d1a0625d8d3ebdd4bc5fb410a

SHA1
fcd7812a24b11e070e4974dd360089764c0555b8

SHA256
12c7cc1d8bae77c0f4b4ab27c2f6fca4b795245988eab91cb4ca00158626cfb5

SHA512
a41af9ca01e022516ae59ac4c898aa6c7e36c4b43d16498b46fd628bcda1f7680e8344d6b8e03e538da79bda241b3b9fe8b0fa3cc501754514be1b1c93cdd346

Download Submit
C:\Users\Admin\AppData\Roaming\Windata\VJAOLB.exe
MD5
3814443d1a0625d8d3ebdd4bc5fb410a

SHA1
fcd7812a24b11e070e4974dd360089764c0555b8

SHA256
12c7cc1d8bae77c0f4b4ab27c2f6fca4b795245988eab91cb4ca00158626cfb5

SHA512
a41af9ca01e022516ae59ac4c898aa6c7e36c4b43d16498b46fd628bcda1f7680e8344d6b8e03e538da79bda241b3b9fe8b0fa3cc501754514be1b1c93cdd346

Download Submit
C:\Users\Admin\AppData\Roaming\Windata\VJAOLB.exe
MD5
3814443d1a0625d8d3ebdd4bc5fb410a

SHA1
fcd7812a24b11e070e4974dd360089764c0555b8

SHA256
12c7cc1d8bae77c0f4b4ab27c2f6fca4b795245988eab91cb4ca00158626cfb5

SHA512
a41af9ca01e022516ae59ac4c898aa6c7e36c4b43d16498b46fd628bcda1f7680e8344d6b8e03e538da79bda241b3b9fe8b0fa3cc501754514be1b1c93cdd346

Download Submit
C:\Users\Admin\AppData\Roaming\Windata\VJAOLB.exe
MD5
3814443d1a0625d8d3ebdd4bc5fb410a

SHA1
fcd7812a24b11e070e4974dd360089764c0555b8

SHA256
12c7cc1d8bae77c0f4b4ab27c2f6fca4b795245988eab91cb4ca00158626cfb5

SHA512
a41af9ca01e022516ae59ac4c898aa6c7e36c4b43d16498b46fd628bcda1f7680e8344d6b8e03e538da79bda241b3b9fe8b0fa3cc501754514be1b1c93cdd346

Download Submit
memory/476-4-0x0000000003420000-0x0000000003424000-memory.dmp

Filesize
16KB

Download
memory/520-7-0x0000000000000000-mapping.dmp

Download
memory/1360-9-0x0000000000000000-mapping.dmp

Download
memory/1400-2-0x0000000000000000-mapping.dmp

Download
memory/1448-11-0x0000000000000000-mapping.dmp

Download
memory/1692-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads