Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
10-08-2022 10:54
Static task
static1
Behavioral task
behavioral1
Sample
DOCUMENTO ORDINARIO.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
DOCUMENTO ORDINARIO.exe
Resource
win10v2004-20220721-en
General
-
Target
DOCUMENTO ORDINARIO.exe
-
Size
4.4MB
-
MD5
d30119efcade19d0ed3ae5cd84ff7423
-
SHA1
3ab05af68868dcffc190ce570f9ec53f16116cfd
-
SHA256
cc65ae06615f6fac3823126248fb294923b983c2c115ff1ab59806f3072b75ef
-
SHA512
de5a4fa338c620ee94fdd9c64a67df4a78bdbd62d6dfc78a999a04d4ee0a6fd112f7c45c7dfc635690b8c67fd9256584f7ff146f060f63596dbeae26f3afe370
Malware Config
Extracted
bitrat
1.38
vhsivhyugve.duckdns.org:1880
-
communication_password
202cb962ac59075b964b07152d234b70
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4176-141-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4176-142-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4176-143-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4176-144-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4176-147-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
DOCUMENTO ORDINARIO.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation DOCUMENTO ORDINARIO.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
DOCUMENTO ORDINARIO.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Qcbidsjj\\chrome.exe\"" DOCUMENTO ORDINARIO.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
InstallUtil.exepid process 4176 InstallUtil.exe 4176 InstallUtil.exe 4176 InstallUtil.exe 4176 InstallUtil.exe 4176 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DOCUMENTO ORDINARIO.exedescription pid process target process PID 1100 set thread context of 4176 1100 DOCUMENTO ORDINARIO.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeDOCUMENTO ORDINARIO.exepid process 4364 powershell.exe 4364 powershell.exe 1100 DOCUMENTO ORDINARIO.exe 1100 DOCUMENTO ORDINARIO.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DOCUMENTO ORDINARIO.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1100 DOCUMENTO ORDINARIO.exe Token: SeDebugPrivilege 4364 powershell.exe Token: SeShutdownPrivilege 4176 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exepid process 4176 InstallUtil.exe 4176 InstallUtil.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
DOCUMENTO ORDINARIO.exedescription pid process target process PID 1100 wrote to memory of 4364 1100 DOCUMENTO ORDINARIO.exe powershell.exe PID 1100 wrote to memory of 4364 1100 DOCUMENTO ORDINARIO.exe powershell.exe PID 1100 wrote to memory of 4364 1100 DOCUMENTO ORDINARIO.exe powershell.exe PID 1100 wrote to memory of 4176 1100 DOCUMENTO ORDINARIO.exe InstallUtil.exe PID 1100 wrote to memory of 4176 1100 DOCUMENTO ORDINARIO.exe InstallUtil.exe PID 1100 wrote to memory of 4176 1100 DOCUMENTO ORDINARIO.exe InstallUtil.exe PID 1100 wrote to memory of 4176 1100 DOCUMENTO ORDINARIO.exe InstallUtil.exe PID 1100 wrote to memory of 4176 1100 DOCUMENTO ORDINARIO.exe InstallUtil.exe PID 1100 wrote to memory of 4176 1100 DOCUMENTO ORDINARIO.exe InstallUtil.exe PID 1100 wrote to memory of 4176 1100 DOCUMENTO ORDINARIO.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOCUMENTO ORDINARIO.exe"C:\Users\Admin\AppData\Local\Temp\DOCUMENTO ORDINARIO.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4176
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1100-130-0x00000000000F0000-0x000000000055C000-memory.dmpFilesize
4.4MB
-
memory/1100-131-0x00000000029B0000-0x00000000029D2000-memory.dmpFilesize
136KB
-
memory/4176-145-0x0000000074770000-0x00000000747A9000-memory.dmpFilesize
228KB
-
memory/4176-142-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4176-149-0x0000000074AF0000-0x0000000074B29000-memory.dmpFilesize
228KB
-
memory/4176-148-0x0000000074770000-0x00000000747A9000-memory.dmpFilesize
228KB
-
memory/4176-147-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4176-146-0x0000000074AF0000-0x0000000074B29000-memory.dmpFilesize
228KB
-
memory/4176-144-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4176-143-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4176-140-0x0000000000000000-mapping.dmp
-
memory/4176-141-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4364-137-0x0000000005FC0000-0x0000000005FDE000-memory.dmpFilesize
120KB
-
memory/4364-139-0x00000000064D0000-0x00000000064EA000-memory.dmpFilesize
104KB
-
memory/4364-138-0x0000000007800000-0x0000000007E7A000-memory.dmpFilesize
6.5MB
-
memory/4364-132-0x0000000000000000-mapping.dmp
-
memory/4364-133-0x0000000002A20000-0x0000000002A56000-memory.dmpFilesize
216KB
-
memory/4364-136-0x00000000059D0000-0x0000000005A36000-memory.dmpFilesize
408KB
-
memory/4364-135-0x00000000058F0000-0x0000000005956000-memory.dmpFilesize
408KB
-
memory/4364-134-0x00000000050F0000-0x0000000005718000-memory.dmpFilesize
6.2MB