Analysis
- max time kernel
69s - max time network
138s - platform
windows10_x64 - resource
win10v20210410 - submitted
02/05/2021, 06:32
General
- Target SOLICITUD DE COTIZACIÓN0832_TXT.pif.exe
- Size 1.2MB
- Sample210502-edcpa2w7qa
- SHA256 33378b4ff2e8e5d64380bf24d787e4cae639cd41ceafbeeff82d7cf7a74be69a
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOLICITUD DE COTIZACIÓN0832_TXT.pif.exe"C:\Users\Admin\AppData\Local\Temp\SOLICITUD DE COTIZACIÓN0832_TXT.pif.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\SOLICITUD DE COTIZACIÓN0832_TXT.pif.exe"C:\Users\Admin\AppData\Local\Temp\SOLICITUD DE COTIZACIÓN0832_TXT.pif.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 14642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/508-114-0x00000000008E0000-0x00000000008E1000-memory.dmp
memory/508-116-0x0000000005250000-0x0000000005251000-memory.dmp
memory/508-117-0x0000000005550000-0x0000000005551000-memory.dmp
memory/508-118-0x00000000051B0000-0x00000000051DC000-memory.dmp
memory/508-121-0x0000000006400000-0x0000000006401000-memory.dmp
memory/2344-122-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2344-126-0x00000000031D0000-0x00000000031E7000-memory.dmp
memory/2344-127-0x0000000005A40000-0x0000000005A41000-memory.dmp
memory/2344-128-0x0000000005F10000-0x0000000005F11000-memory.dmp