Analysis
- max time kernel
141s - max time network
156s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
06/02/2022, 12:31
Static task
static1
Behavioral task
behavioral1
Sample
comprobante de pago.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
comprobante de pago.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target comprobante de pago.exe
- Size 122KB
- Sample220206-pp2qeaabd7
- SHA256 17fdcc607fd88eae0d0c1c70bbb2d0142fab586b95fc5952b63e568b5456b01d
- MD5 29d302abfd720451a55f83e5b2e26d24
- SHA1 8aaec9683a0fd5709b48f840d527d9517889a259
- SHA512 3c5e99ac69ef38ccf343ff7b92884eff092dfdb635f85264a0f8ffb2c1f30b5b28ff31e4d6e222b76f334ebffcdc81f2dcc41e1d840a3988b59f7627b4b565c8
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 780 powershell.exe 968 powershell.exe 1384 powershell.exe 1836 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1436 comprobante de pago.exe Token: SeDebugPrivilege 780 powershell.exe Token: SeIncreaseQuotaPrivilege 780 powershell.exe Token: SeSecurityPrivilege 780 powershell.exe Token: SeTakeOwnershipPrivilege 780 powershell.exe Token: SeLoadDriverPrivilege 780 powershell.exe Token: SeSystemProfilePrivilege 780 powershell.exe Token: SeSystemtimePrivilege 780 powershell.exe Token: SeProfSingleProcessPrivilege 780 powershell.exe Token: SeIncBasePriorityPrivilege 780 powershell.exe Token: SeCreatePagefilePrivilege 780 powershell.exe Token: SeBackupPrivilege 780 powershell.exe Token: SeRestorePrivilege 780 powershell.exe Token: SeShutdownPrivilege 780 powershell.exe Token: SeDebugPrivilege 780 powershell.exe Token: SeSystemEnvironmentPrivilege 780 powershell.exe Token: SeRemoteShutdownPrivilege 780 powershell.exe Token: SeUndockPrivilege 780 powershell.exe Token: SeManageVolumePrivilege 780 powershell.exe Token: 33 780 powershell.exe Token: 34 780 powershell.exe Token: 35 780 powershell.exe Token: SeDebugPrivilege 968 powershell.exe Token: SeIncreaseQuotaPrivilege 968 powershell.exe Token: SeSecurityPrivilege 968 powershell.exe Token: SeTakeOwnershipPrivilege 968 powershell.exe Token: SeLoadDriverPrivilege 968 powershell.exe Token: SeSystemProfilePrivilege 968 powershell.exe Token: SeSystemtimePrivilege 968 powershell.exe Token: SeProfSingleProcessPrivilege 968 powershell.exe Token: SeIncBasePriorityPrivilege 968 powershell.exe Token: SeCreatePagefilePrivilege 968 powershell.exe Token: SeBackupPrivilege 968 powershell.exe Token: SeRestorePrivilege 968 powershell.exe Token: SeShutdownPrivilege 968 powershell.exe Token: SeDebugPrivilege 968 powershell.exe Token: SeSystemEnvironmentPrivilege 968 powershell.exe Token: SeRemoteShutdownPrivilege 968 powershell.exe Token: SeUndockPrivilege 968 powershell.exe Token: SeManageVolumePrivilege 968 powershell.exe Token: 33 968 powershell.exe Token: 34 968 powershell.exe Token: 35 968 powershell.exe Token: SeDebugPrivilege 1384 powershell.exe Token: SeIncreaseQuotaPrivilege 1384 powershell.exe Token: SeSecurityPrivilege 1384 powershell.exe Token: SeTakeOwnershipPrivilege 1384 powershell.exe Token: SeLoadDriverPrivilege 1384 powershell.exe Token: SeSystemProfilePrivilege 1384 powershell.exe Token: SeSystemtimePrivilege 1384 powershell.exe Token: SeProfSingleProcessPrivilege 1384 powershell.exe Token: SeIncBasePriorityPrivilege 1384 powershell.exe Token: SeCreatePagefilePrivilege 1384 powershell.exe Token: SeBackupPrivilege 1384 powershell.exe Token: SeRestorePrivilege 1384 powershell.exe Token: SeShutdownPrivilege 1384 powershell.exe Token: SeDebugPrivilege 1384 powershell.exe Token: SeSystemEnvironmentPrivilege 1384 powershell.exe Token: SeRemoteShutdownPrivilege 1384 powershell.exe Token: SeUndockPrivilege 1384 powershell.exe Token: SeManageVolumePrivilege 1384 powershell.exe Token: 33 1384 powershell.exe Token: 34 1384 powershell.exe Token: 35 1384 powershell.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1436 wrote to memory of 780 1436 comprobante de pago.exe 28 PID 1436 wrote to memory of 780 1436 comprobante de pago.exe 28 PID 1436 wrote to memory of 780 1436 comprobante de pago.exe 28 PID 1436 wrote to memory of 780 1436 comprobante de pago.exe 28 PID 1436 wrote to memory of 968 1436 comprobante de pago.exe 33 PID 1436 wrote to memory of 968 1436 comprobante de pago.exe 33 PID 1436 wrote to memory of 968 1436 comprobante de pago.exe 33 PID 1436 wrote to memory of 968 1436 comprobante de pago.exe 33 PID 1436 wrote to memory of 1384 1436 comprobante de pago.exe 35 PID 1436 wrote to memory of 1384 1436 comprobante de pago.exe 35 PID 1436 wrote to memory of 1384 1436 comprobante de pago.exe 35 PID 1436 wrote to memory of 1384 1436 comprobante de pago.exe 35 PID 1436 wrote to memory of 1344 1436 comprobante de pago.exe 37 PID 1436 wrote to memory of 1344 1436 comprobante de pago.exe 37 PID 1436 wrote to memory of 1344 1436 comprobante de pago.exe 37 PID 1436 wrote to memory of 1344 1436 comprobante de pago.exe 37 PID 1436 wrote to memory of 1836 1436 comprobante de pago.exe 39 PID 1436 wrote to memory of 1836 1436 comprobante de pago.exe 39 PID 1436 wrote to memory of 1836 1436 comprobante de pago.exe 39 PID 1436 wrote to memory of 1836 1436 comprobante de pago.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\comprobante de pago.exe"C:\Users\Admin\AppData\Local\Temp\comprobante de pago.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 127.0.0.12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:780
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 127.0.0.12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:968
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 127.0.0.12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 127.0.0.12⤵PID:1344
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 127.0.0.12⤵
- Suspicious behavior: EnumeratesProcesses
PID:1836
-