Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
03-05-2021 00:46
Static task
static1
Behavioral task
behavioral1
Sample
Factura Serfinanza106109596363318359608727771.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Factura Serfinanza106109596363318359608727771.exe
Resource
win10v20210410
General
-
Target
Factura Serfinanza106109596363318359608727771.exe
-
Size
1.8MB
-
MD5
e13f7ded8bfc14808ca964c5dec10b9f
-
SHA1
c5606c21b84a858ed7b54da2a7f17802fffcddb3
-
SHA256
e8cac456b3e4a072d16142f0dd9f9b0500013cfefe7359e4293d4cff61f9eaf7
-
SHA512
91d0cfb0e051c3ab5f8b97a5d8afb83476d825d7e87760a93220fd44cfd42c93b6b394341924521202988595e1a787586c087b614d8ab7df42563ccc2b490e7d
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exepid process 1236 PxxoServicesTrialNet1.exe 3276 PxxoServicesTrialNet1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Factura Serfinanza106109596363318359608727771.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Factura Serfinanza106109596363318359608727771.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" Factura Serfinanza106109596363318359608727771.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesTrialNet1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" PxxoServicesTrialNet1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
Processes:
Factura Serfinanza106109596363318359608727771.exePxxoServicesTrialNet1.exepid process 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Factura Serfinanza106109596363318359608727771.exePxxoServicesTrialNet1.exedescription pid process target process PID 1828 set thread context of 3880 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1236 set thread context of 3276 1236 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 3276 timeout.exe 3400 timeout.exe -
Modifies registry class 1 IoCs
Processes:
Factura Serfinanza106109596363318359608727771.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings Factura Serfinanza106109596363318359608727771.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Factura Serfinanza106109596363318359608727771.exePxxoServicesTrialNet1.exepid process 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1828 Factura Serfinanza106109596363318359608727771.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe 1236 PxxoServicesTrialNet1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Factura Serfinanza106109596363318359608727771.exePxxoServicesTrialNet1.exedescription pid process Token: SeDebugPrivilege 1828 Factura Serfinanza106109596363318359608727771.exe Token: SeDebugPrivilege 1236 PxxoServicesTrialNet1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 3276 PxxoServicesTrialNet1.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
Factura Serfinanza106109596363318359608727771.execmd.exeFactura Serfinanza106109596363318359608727771.exeWScript.execmd.exePxxoServicesTrialNet1.execmd.exedescription pid process target process PID 1828 wrote to memory of 2620 1828 Factura Serfinanza106109596363318359608727771.exe cmd.exe PID 1828 wrote to memory of 2620 1828 Factura Serfinanza106109596363318359608727771.exe cmd.exe PID 1828 wrote to memory of 2620 1828 Factura Serfinanza106109596363318359608727771.exe cmd.exe PID 2620 wrote to memory of 3276 2620 cmd.exe timeout.exe PID 2620 wrote to memory of 3276 2620 cmd.exe timeout.exe PID 2620 wrote to memory of 3276 2620 cmd.exe timeout.exe PID 1828 wrote to memory of 3700 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1828 wrote to memory of 3700 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1828 wrote to memory of 3700 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1828 wrote to memory of 3880 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1828 wrote to memory of 3880 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1828 wrote to memory of 3880 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1828 wrote to memory of 3880 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1828 wrote to memory of 3880 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1828 wrote to memory of 3880 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1828 wrote to memory of 3880 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1828 wrote to memory of 3880 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1828 wrote to memory of 3880 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 1828 wrote to memory of 3880 1828 Factura Serfinanza106109596363318359608727771.exe Factura Serfinanza106109596363318359608727771.exe PID 3880 wrote to memory of 3772 3880 Factura Serfinanza106109596363318359608727771.exe WScript.exe PID 3880 wrote to memory of 3772 3880 Factura Serfinanza106109596363318359608727771.exe WScript.exe PID 3880 wrote to memory of 3772 3880 Factura Serfinanza106109596363318359608727771.exe WScript.exe PID 3772 wrote to memory of 2144 3772 WScript.exe cmd.exe PID 3772 wrote to memory of 2144 3772 WScript.exe cmd.exe PID 3772 wrote to memory of 2144 3772 WScript.exe cmd.exe PID 2144 wrote to memory of 1236 2144 cmd.exe PxxoServicesTrialNet1.exe PID 2144 wrote to memory of 1236 2144 cmd.exe PxxoServicesTrialNet1.exe PID 2144 wrote to memory of 1236 2144 cmd.exe PxxoServicesTrialNet1.exe PID 1236 wrote to memory of 2728 1236 PxxoServicesTrialNet1.exe cmd.exe PID 1236 wrote to memory of 2728 1236 PxxoServicesTrialNet1.exe cmd.exe PID 1236 wrote to memory of 2728 1236 PxxoServicesTrialNet1.exe cmd.exe PID 2728 wrote to memory of 3400 2728 cmd.exe timeout.exe PID 2728 wrote to memory of 3400 2728 cmd.exe timeout.exe PID 2728 wrote to memory of 3400 2728 cmd.exe timeout.exe PID 1236 wrote to memory of 3276 1236 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 1236 wrote to memory of 3276 1236 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 1236 wrote to memory of 3276 1236 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 1236 wrote to memory of 3276 1236 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 1236 wrote to memory of 3276 1236 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 1236 wrote to memory of 3276 1236 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 1236 wrote to memory of 3276 1236 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 1236 wrote to memory of 3276 1236 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 1236 wrote to memory of 3276 1236 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 1236 wrote to memory of 3276 1236 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza106109596363318359608727771.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza106109596363318359608727771.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza106109596363318359608727771.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza106109596363318359608727771.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza106109596363318359608727771.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza106109596363318359608727771.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
e13f7ded8bfc14808ca964c5dec10b9f
SHA1c5606c21b84a858ed7b54da2a7f17802fffcddb3
SHA256e8cac456b3e4a072d16142f0dd9f9b0500013cfefe7359e4293d4cff61f9eaf7
SHA51291d0cfb0e051c3ab5f8b97a5d8afb83476d825d7e87760a93220fd44cfd42c93b6b394341924521202988595e1a787586c087b614d8ab7df42563ccc2b490e7d
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
e13f7ded8bfc14808ca964c5dec10b9f
SHA1c5606c21b84a858ed7b54da2a7f17802fffcddb3
SHA256e8cac456b3e4a072d16142f0dd9f9b0500013cfefe7359e4293d4cff61f9eaf7
SHA51291d0cfb0e051c3ab5f8b97a5d8afb83476d825d7e87760a93220fd44cfd42c93b6b394341924521202988595e1a787586c087b614d8ab7df42563ccc2b490e7d
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
e13f7ded8bfc14808ca964c5dec10b9f
SHA1c5606c21b84a858ed7b54da2a7f17802fffcddb3
SHA256e8cac456b3e4a072d16142f0dd9f9b0500013cfefe7359e4293d4cff61f9eaf7
SHA51291d0cfb0e051c3ab5f8b97a5d8afb83476d825d7e87760a93220fd44cfd42c93b6b394341924521202988595e1a787586c087b614d8ab7df42563ccc2b490e7d
-
memory/1236-137-0x0000000005F30000-0x0000000005F31000-memory.dmpFilesize
4KB
-
memory/1236-128-0x0000000000000000-mapping.dmp
-
memory/1828-116-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/1828-117-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/1828-119-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/1828-114-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1828-121-0x0000000007050000-0x0000000007051000-memory.dmpFilesize
4KB
-
memory/2144-127-0x0000000000000000-mapping.dmp
-
memory/2620-118-0x0000000000000000-mapping.dmp
-
memory/2728-135-0x0000000000000000-mapping.dmp
-
memory/3276-120-0x0000000000000000-mapping.dmp
-
memory/3276-140-0x0000000000413FA4-mapping.dmp
-
memory/3276-142-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3400-136-0x0000000000000000-mapping.dmp
-
memory/3772-125-0x0000000000000000-mapping.dmp
-
memory/3880-124-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3880-123-0x0000000000413FA4-mapping.dmp
-
memory/3880-122-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB