4c57fb95b67660646d6e37a04eb78e010c6a629e1fd8590aaeb4093dea0fad1f

General

Target

orden pendiente #3422.exe
Size

382KB
MD5

7236e64dc6eb9e21ae4c16239820713f
SHA1

f97cc4ecc429d57d44674511d518f9e6b428e7b3
SHA256

4c57fb95b67660646d6e37a04eb78e010c6a629e1fd8590aaeb4093dea0fad1f
SHA512

b3d6a3f4ff123a344d91b35e2f09fc0cf470756f0439d4b71a250681ac71d60a60f062e5979a6d62f18cf10599d2e0d740e9857a9ed6834b1736360c95bf32c2

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\I4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7 = "C:\\Users\\Admin\\AppData\\Roaming\\I4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7\\I4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

orden pendiente #3422.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	orden pendiente #3422.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	orden pendiente #3422.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

orden pendiente #3422.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" orden pendiente #3422.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	orden pendiente #3422.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\I4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7 = "C:\\Users\\Admin\\AppData\\Roaming\\I4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7\\I4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7.exe"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\I4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7 = "C:\\Users\\Admin\\AppData\\Roaming\\I4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7\\I4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7.exe"	iexplore.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

orden pendiente #3422.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	orden pendiente #3422.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

orden pendiente #3422.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	orden pendiente #3422.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	orden pendiente #3422.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

orden pendiente #3422.exeorden pendiente #3422.exe

description	pid	process	target process
PID 2100 set thread context of 1588	2100	orden pendiente #3422.exe	orden pendiente #3422.exe
PID 1588 set thread context of 1936	1588	orden pendiente #3422.exe	iexplore.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

orden pendiente #3422.exe

pid process

1588 orden pendiente #3422.exe
1588 orden pendiente #3422.exe
1588 orden pendiente #3422.exe
1588 orden pendiente #3422.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

orden pendiente #3422.exe

pid process

1588 orden pendiente #3422.exe

pid	process
1588	orden pendiente #3422.exe
1588	orden pendiente #3422.exe
1588	orden pendiente #3422.exe
1588	orden pendiente #3422.exe

pid	process
1588	orden pendiente #3422.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

orden pendiente #3422.exeorden pendiente #3422.exe

description	pid	process	target process
PID 2100 wrote to memory of 1588	2100	orden pendiente #3422.exe	orden pendiente #3422.exe
PID 2100 wrote to memory of 1588	2100	orden pendiente #3422.exe	orden pendiente #3422.exe
PID 2100 wrote to memory of 1588	2100	orden pendiente #3422.exe	orden pendiente #3422.exe
PID 2100 wrote to memory of 1588	2100	orden pendiente #3422.exe	orden pendiente #3422.exe
PID 2100 wrote to memory of 1588	2100	orden pendiente #3422.exe	orden pendiente #3422.exe
PID 2100 wrote to memory of 1588	2100	orden pendiente #3422.exe	orden pendiente #3422.exe
PID 2100 wrote to memory of 1588	2100	orden pendiente #3422.exe	orden pendiente #3422.exe
PID 1588 wrote to memory of 1936	1588	orden pendiente #3422.exe	iexplore.exe
PID 1588 wrote to memory of 1936	1588	orden pendiente #3422.exe	iexplore.exe
PID 1588 wrote to memory of 1936	1588	orden pendiente #3422.exe	iexplore.exe
PID 1588 wrote to memory of 1936	1588	orden pendiente #3422.exe	iexplore.exe
PID 1588 wrote to memory of 1936	1588	orden pendiente #3422.exe	iexplore.exe
PID 1588 wrote to memory of 1936	1588	orden pendiente #3422.exe	iexplore.exe
PID 1588 wrote to memory of 1936	1588	orden pendiente #3422.exe	iexplore.exe
PID 1588 wrote to memory of 1936	1588	orden pendiente #3422.exe	iexplore.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

orden pendiente #3422.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	orden pendiente #3422.exe

C:\Users\Admin\AppData\Local\Temp\orden pendiente #3422.exe
"C:\Users\Admin\AppData\Local\Temp\orden pendiente #3422.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2100

C:\Users\Admin\AppData\Local\Temp\orden pendiente #3422.exe
"C:\Users\Admin\AppData\Local\Temp\orden pendiente #3422.exe"
2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1588

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\orden pendiente #3422.exe
3⤵
- Adds policy Run key to start application
- Adds Run key to start application
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:3436

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe a0bc01ace4d643dd8b915a8a2e6b5150 u3pCchQsYkujnCz7FYwSeA.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p
1⤵
PID:32

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

3

T1089

Modify Registry

7

T1112

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-137-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1588-140-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2100-130-0x0000000000510000-0x0000000000576000-memory.dmp

Filesize
408KB

Download
memory/2100-131-0x00000000054E0000-0x0000000005A84000-memory.dmp

Filesize
5.6MB

Download
memory/2100-132-0x0000000004F30000-0x0000000004FC2000-memory.dmp

Filesize
584KB

Download
memory/2100-133-0x0000000004F30000-0x00000000054D4000-memory.dmp

Filesize
5.6MB

Download
memory/2100-134-0x00000000050C0000-0x00000000050CA000-memory.dmp

Filesize
40KB

Download
memory/2100-135-0x00000000073E0000-0x000000000747C000-memory.dmp

Filesize
624KB

Download
memory/2100-136-0x0000000007670000-0x00000000076D6000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads