Analysis
-
max time kernel
113s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
09-06-2022 10:37
Static task
static1
Behavioral task
behavioral1
Sample
DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe
Resource
win10-20220414-en
Behavioral task
behavioral3
Sample
DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral4
Sample
DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe
Resource
win11-20220223-en
General
-
Target
DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe
-
Size
160KB
-
MD5
c9e93cb3148aa7fd9aeb11e3deaaa994
-
SHA1
4dec478206a5ac46a560f8bb36b8ef7abf7cadb9
-
SHA256
86456c0b66bf59cbdddd5419cca3b24d4d303b8e7ed5261181ae1ab3933e55e8
-
SHA512
0c80ee1d9f61c8d73902673103bfe3b3dd480b564dc2a4f9822f78d6eef92441b93afbfbc9236ab9eb210a2911d66ffa82bf39001c2ddb7f4925347bbb69417b
Malware Config
Extracted
bitrat
1.38
reyhrwwet4y.duckdns.org :1880
-
communication_password
202cb962ac59075b964b07152d234b70
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1100-62-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1100-64-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1100-65-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1100-68-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1100-67-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1100-69-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1100-71-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1100-72-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\spotify = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ordvhop\\spotify.exe\"" DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
InstallUtil.exepid process 1100 InstallUtil.exe 1100 InstallUtil.exe 1100 InstallUtil.exe 1100 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exedescription pid process target process PID 1628 set thread context of 1100 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1144 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exepid process 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe Token: SeDebugPrivilege 1100 InstallUtil.exe Token: SeShutdownPrivilege 1100 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exepid process 1100 InstallUtil.exe 1100 InstallUtil.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.execmd.exedescription pid process target process PID 1628 wrote to memory of 1636 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe cmd.exe PID 1628 wrote to memory of 1636 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe cmd.exe PID 1628 wrote to memory of 1636 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe cmd.exe PID 1628 wrote to memory of 1636 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe cmd.exe PID 1628 wrote to memory of 1804 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe cmd.exe PID 1628 wrote to memory of 1804 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe cmd.exe PID 1628 wrote to memory of 1804 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe cmd.exe PID 1628 wrote to memory of 1804 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe cmd.exe PID 1804 wrote to memory of 1144 1804 cmd.exe timeout.exe PID 1804 wrote to memory of 1144 1804 cmd.exe timeout.exe PID 1804 wrote to memory of 1144 1804 cmd.exe timeout.exe PID 1804 wrote to memory of 1144 1804 cmd.exe timeout.exe PID 1628 wrote to memory of 1100 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe InstallUtil.exe PID 1628 wrote to memory of 1100 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe InstallUtil.exe PID 1628 wrote to memory of 1100 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe InstallUtil.exe PID 1628 wrote to memory of 1100 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe InstallUtil.exe PID 1628 wrote to memory of 1100 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe InstallUtil.exe PID 1628 wrote to memory of 1100 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe InstallUtil.exe PID 1628 wrote to memory of 1100 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe InstallUtil.exe PID 1628 wrote to memory of 1100 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe InstallUtil.exe PID 1628 wrote to memory of 1100 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe InstallUtil.exe PID 1628 wrote to memory of 1100 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe InstallUtil.exe PID 1628 wrote to memory of 1100 1628 DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe"C:\Users\Admin\AppData\Local\Temp\DENUNCIA VIRTUAL IMPUESTA EN SU CONTRA.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 202⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1100-66-0x00000000007E2730-mapping.dmp
-
memory/1100-68-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1100-62-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1100-72-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1100-64-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1100-71-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1100-65-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1100-69-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1100-67-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1100-61-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1144-60-0x0000000000000000-mapping.dmp
-
memory/1628-58-0x00000000053A0000-0x00000000053EC000-memory.dmpFilesize
304KB
-
memory/1628-54-0x0000000000970000-0x000000000099E000-memory.dmpFilesize
184KB
-
memory/1628-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/1628-57-0x0000000005C10000-0x0000000005DE8000-memory.dmpFilesize
1.8MB
-
memory/1636-56-0x0000000000000000-mapping.dmp
-
memory/1804-59-0x0000000000000000-mapping.dmp