Analysis

  • max time kernel
    152s
  • max time network
    131s
  • platform
    windows10_x64
  • resource
    win10-20220414-es
  • resource tags

    arch:x64arch:x86image:win10-20220414-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    18-07-2022 18:24

General

  • Target

    CFDI 826271 71074.exe

  • Size

    334.4MB

  • MD5

    7ac85137fd754a9a31f724c0c9883162

  • SHA1

    26b5f8d21c2ead0eeda43ab571bf6ec1b672910c

  • SHA256

    8b39ad4a31e74ca2ff52b3339230fab9793e86a8a7370b64ee63aac3825a0ea7

  • SHA512

    957c9a6f9813b9df8275f7a9fc4bb65a56f2c7a653bf6853cc1deaebab0eaf9464c187ba6a3aa65b10f3d7fbefa04345574e752366035c28ae492bdd4c28ef00

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CFDI 826271 71074.exe
    "C:\Users\Admin\AppData\Local\Temp\CFDI 826271 71074.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1032
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA3AA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2796
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4864
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE
        3⤵
        • Executes dropped EXE
        • Sets file execution options in registry
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1536
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Modifies firewall policy service
          • Sets file execution options in registry
          • Checks BIOS information in registry
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies Internet Explorer Protected Mode
          • Modifies Internet Explorer Protected Mode Banner
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3312

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    1KB

    MD5

    b42b8394f52b01b93879625688c3d79d

    SHA1

    3ed5877ab13e7655482c19e8b7511f8b2bfcdbb3

    SHA256

    b7b0a0ab5e777b74a8d7ec285804091eb3a4c71fcc2c57cddfa8541d05409cdd

    SHA512

    86357e54c29ee9c107b5655d457121f35117565fae4fdd018e56079eb7ca012e4afe0a5d5562bc2996b932b02450ad0fbb7f27047315b524138a0fe08c4f79c2

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    Filesize

    45KB

    MD5

    5f640bd48e2547b4c1a7421f080f815f

    SHA1

    a8f4a743f5b7da5cba7b8e6fb1d7ad4d67fefc6a

    SHA256

    916c83c7c8d059aea295523b8b3f24e1e2436df894f7fae26c47c9bad04baa9c

    SHA512

    a6ac100a351946b1bbb40c98aeda6e16e12f90f81063aff08c16d4d9afec8ed65c2cbcf25b42946627d67653f75740b1137dab625c99e9492ba35aba68b79a8e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    16KB

    MD5

    3091e669afaea28bddb5ecacae736cdf

    SHA1

    30bed888f86a67553184dd3231e31b81ce0267a3

    SHA256

    037181cfc8fd9470761f9ee34e3dd40872c1980e943d88f393029d4b22887f88

    SHA512

    068e2f6e69950884ac2edc8ccc3475c45862378a7746c2fd0bed093cc062ea2875b39bd8d3953b563f2e5729b24dafc2af4abf78c0b349e046a585bdb7ac822d

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE

    Filesize

    333.9MB

    MD5

    f51a742f76121dd26e772ddbd8ae7621

    SHA1

    5f7c14aca06c7d6a56fb33339fd6f118a68f5751

    SHA256

    4703f4ade6f2469b9c785d4ebbca86bee3bb53405d58e553dbf70b9edc151a64

    SHA512

    644522827ba22afd8db0c501c5ecdf9a14c9a1dbb33c8cc3c0a1ba02346f1266d5d75e4fdc0fff8c880acd889cad523377b3bfd158eb4e710fe338d49957b4e0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE

    Filesize

    333.9MB

    MD5

    f51a742f76121dd26e772ddbd8ae7621

    SHA1

    5f7c14aca06c7d6a56fb33339fd6f118a68f5751

    SHA256

    4703f4ade6f2469b9c785d4ebbca86bee3bb53405d58e553dbf70b9edc151a64

    SHA512

    644522827ba22afd8db0c501c5ecdf9a14c9a1dbb33c8cc3c0a1ba02346f1266d5d75e4fdc0fff8c880acd889cad523377b3bfd158eb4e710fe338d49957b4e0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE

    Filesize

    272.5MB

    MD5

    5d6188c63f1575fce9fb4bee4340999c

    SHA1

    7abfc8cb3a48e18943ece9b0ebb2e7ad71386eeb

    SHA256

    70e200068fe9e79c48e584232041d82dd29c7f5658f5cc1a2f69e839bc5addd0

    SHA512

    9c3c452b4cc2f0ece75de7c2465e08c7ddc6501f5aed7db8c48d11c2475a43e553ac102e4eccab5ec73b163fdddd7f890a1858efc68a5182641e0865061f284a

  • memory/1032-171-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-147-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-122-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-123-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-124-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-125-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-126-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-127-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-129-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-130-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-131-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-132-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-133-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-134-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-135-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-136-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-173-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-138-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-139-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-140-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-141-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-142-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-144-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-143-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-145-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-146-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-175-0x0000000005000000-0x000000000500A000-memory.dmp

    Filesize

    40KB

  • memory/1032-148-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-149-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-150-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-151-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-152-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-153-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-154-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-155-0x00000000007D0000-0x00000000007F6000-memory.dmp

    Filesize

    152KB

  • memory/1032-156-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-157-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-158-0x0000000005660000-0x0000000005B5E000-memory.dmp

    Filesize

    5.0MB

  • memory/1032-159-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-160-0x0000000005030000-0x00000000050C2000-memory.dmp

    Filesize

    584KB

  • memory/1032-161-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-162-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-163-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-164-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-165-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-166-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-167-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-168-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-169-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-170-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-120-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-172-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-137-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-174-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-121-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-176-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-177-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-178-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-179-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-180-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-181-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-182-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-183-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-184-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-185-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-186-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-187-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-188-0x00000000773A0000-0x000000007752E000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-206-0x0000000008020000-0x0000000008122000-memory.dmp

    Filesize

    1.0MB

  • memory/1032-209-0x0000000007F10000-0x0000000007F8C000-memory.dmp

    Filesize

    496KB

  • memory/1032-210-0x0000000008130000-0x000000000817C000-memory.dmp

    Filesize

    304KB

  • memory/1032-118-0x0000000000000000-mapping.dmp

  • memory/1536-634-0x00000000004015C6-mapping.dmp

  • memory/1536-719-0x0000000000F70000-0x0000000000FD6000-memory.dmp

    Filesize

    408KB

  • memory/1536-699-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1536-693-0x0000000003050000-0x000000000305C000-memory.dmp

    Filesize

    48KB

  • memory/1536-689-0x00000000013B0000-0x00000000013BD000-memory.dmp

    Filesize

    52KB

  • memory/1536-687-0x0000000000F70000-0x0000000000FD6000-memory.dmp

    Filesize

    408KB

  • memory/1536-670-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2796-288-0x00000000082F0000-0x000000000830C000-memory.dmp

    Filesize

    112KB

  • memory/2796-265-0x0000000007770000-0x00000000077F2000-memory.dmp

    Filesize

    520KB

  • memory/2796-289-0x0000000008E10000-0x0000000008E5B000-memory.dmp

    Filesize

    300KB

  • memory/2796-293-0x0000000008B30000-0x0000000008BA6000-memory.dmp

    Filesize

    472KB

  • memory/2796-304-0x000000000A2C0000-0x000000000A938000-memory.dmp

    Filesize

    6.5MB

  • memory/2796-305-0x0000000009A00000-0x0000000009A1A000-memory.dmp

    Filesize

    104KB

  • memory/2796-283-0x0000000008250000-0x00000000082B6000-memory.dmp

    Filesize

    408KB

  • memory/2796-256-0x0000000004EE0000-0x0000000004F16000-memory.dmp

    Filesize

    216KB

  • memory/2796-284-0x0000000007A50000-0x0000000007A60000-memory.dmp

    Filesize

    64KB

  • memory/2796-281-0x00000000080B0000-0x00000000080D2000-memory.dmp

    Filesize

    136KB

  • memory/2796-282-0x0000000008330000-0x0000000008396000-memory.dmp

    Filesize

    408KB

  • memory/2796-220-0x0000000000000000-mapping.dmp

  • memory/2796-285-0x00000000083A0000-0x00000000086F0000-memory.dmp

    Filesize

    3.3MB

  • memory/2796-261-0x0000000007A80000-0x00000000080A8000-memory.dmp

    Filesize

    6.2MB

  • memory/3312-766-0x0000000000C20000-0x000000000105F000-memory.dmp

    Filesize

    4.2MB

  • memory/3312-767-0x0000000003060000-0x0000000004060000-memory.dmp

    Filesize

    16.0MB

  • memory/3312-768-0x0000000000780000-0x000000000078D000-memory.dmp

    Filesize

    52KB

  • memory/3312-771-0x0000000003060000-0x0000000004060000-memory.dmp

    Filesize

    16.0MB

  • memory/3312-697-0x0000000000000000-mapping.dmp

  • memory/4864-392-0x00000000073F0000-0x0000000007423000-memory.dmp

    Filesize

    204KB

  • memory/4864-406-0x00000000092A0000-0x00000000092EA000-memory.dmp

    Filesize

    296KB

  • memory/4864-402-0x0000000009190000-0x0000000009235000-memory.dmp

    Filesize

    660KB

  • memory/4864-615-0x00000000092F0000-0x00000000092F8000-memory.dmp

    Filesize

    32KB

  • memory/4864-610-0x0000000009310000-0x000000000932A000-memory.dmp

    Filesize

    104KB

  • memory/4864-407-0x0000000009390000-0x0000000009424000-memory.dmp

    Filesize

    592KB

  • memory/4864-393-0x0000000006830000-0x000000000684E000-memory.dmp

    Filesize

    120KB

  • memory/4864-310-0x0000000000000000-mapping.dmp