4c0c348d5fe6d35084087f5df83a5d5f15aa75a30b1dc37204f701383a7685eb

General

Target

TORNIMATIC Cita Urgente A656090897,pdf.exe
Size

1.1MB
MD5

4c2578d24dca065783e2104a5fd9ea25
SHA1

2b02e45f3664aed1e7cdfcf940cdf18a1d9ea6ff
SHA256

4c0c348d5fe6d35084087f5df83a5d5f15aa75a30b1dc37204f701383a7685eb
SHA512

5714b3461793a3474743bdf1ee7911dcf8c58f8aab2f7b64b1f268bc73845c7bd5429a38bcbfbcd6658b5b08dd30b236b5e144aaef2369d38efa1bb87c56f4fd

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

TORNIMATIC Cita Urgente A656090897,pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Murribg = "C:\\Users\\Public\\Libraries\\gbirruM.url"	TORNIMATIC Cita Urgente A656090897,pdf.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

392 2004 WerFault.exe mshta.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

392 WerFault.exe
392 WerFault.exe
392 WerFault.exe
392 WerFault.exe
392 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

392 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 392 WerFault.exe

pid	pid_target	process	target process
392	2004	WerFault.exe	mshta.exe

pid	process
392	WerFault.exe
392	WerFault.exe
392	WerFault.exe
392	WerFault.exe
392	WerFault.exe

pid	process
392	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	392	WerFault.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

TORNIMATIC Cita Urgente A656090897,pdf.exemshta.exe

description	pid	process	target process
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 1036 wrote to memory of 2004	1036	TORNIMATIC Cita Urgente A656090897,pdf.exe	mshta.exe
PID 2004 wrote to memory of 392	2004	mshta.exe	WerFault.exe
PID 2004 wrote to memory of 392	2004	mshta.exe	WerFault.exe
PID 2004 wrote to memory of 392	2004	mshta.exe	WerFault.exe
PID 2004 wrote to memory of 392	2004	mshta.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\TORNIMATIC Cita Urgente A656090897,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\TORNIMATIC Cita Urgente A656090897,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\mshta.exe
C:\Windows\System32\mshta.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 136
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:392

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/392-68-0x0000000000000000-mapping.dmp

Download
memory/392-74-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

Filesize
4KB

Download
memory/1036-60-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1036-62-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1036-65-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/2004-66-0x0000000000000000-mapping.dmp

Download
memory/2004-72-0x0000000010590000-0x000000001060D000-memory.dmp

Filesize
500KB

Download
memory/2004-73-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2004-71-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2004-70-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing