Overview

overview

10

Static

static

DOCUMENTO ...00.exe

windows7-x64

6

DOCUMENTO ...00.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    52s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04-09-2022 08:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe

  • Size

    4.2MB

  • MD5

    5c1b6de769b658c8383f82da13b12176

  • SHA1

    83fb46538bf04529dc36c71ec21a9e200f15e20b

  • SHA256

    69dffcfefd0fc853db57ede9a3a374b11159778df89922af24de678d794901ba

  • SHA512

    bf0a5158cb9d664afcb66e427082cba3d4a7a949a8474092ca50cdd3320096c712c4a73331528bf8e502ff9d227f52dd9acd2f6d3156e73a1199e6c247351251

  • SSDEEP

    98304:a+L6n3g4AP3GMJhq/wsaZ5w2Sa6TLgF6gGsfksF:dL8Q5SZBXaSgF6g0C

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe
    "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 30
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1388
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:916
    • C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe
      "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe"
      2⤵
        PID:432
      • C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe
        "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe"
        2⤵
          PID:824
        • C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe
          "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe"
          2⤵
            PID:1400
          • C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe
            "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe"
            2⤵
              PID:1144
            • C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe
              "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe"
              2⤵
                PID:2016
              • C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe
                "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe"
                2⤵
                  PID:1732
                • C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe
                  "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe"
                  2⤵
                    PID:1948
                  • C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe
                    "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe"
                    2⤵
                      PID:1852
                    • C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe
                      "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe"
                      2⤵
                        PID:588
                      • C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe
                        "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE SENTENCIA DE FALLO 190014003003-2022-00299-00.exe"
                        2⤵
                          PID:1336

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Initial Access

                      Execution

                      Persistence

                      Registry Run Keys / Startup Folder

                      1
                      T1060

                      Privilege Escalation

                      Defense Evasion

                      Modify Registry

                      1
                      T1112

                      Credential Access

                      Discovery

                      System Information Discovery

                      1
                      T1082

                      Lateral Movement

                      Collection

                      Exfiltration

                      Command and Control

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                        Filesize

                        7KB

                        MD5

                        8c220744ddf423c9548238c00863d34b

                        SHA1

                        c5584695c8ced92bec8bf721ebd30ebf8bf8805e

                        SHA256

                        029e216660419af736f3f9a4e89d5c5374929201d0ee9541c6c43b6dfcd0361d

                        SHA512

                        4861dd103618f1468622a947ff3f760cd7e266ed55870d493375678f0359cfc4c7961d4cd26c27e6503c44646ee5620707c6110ba4baa014fb616a07ef908fed

                        Download Submit
                      • memory/916-61-0x0000000000000000-mapping.dmp
                        Download
                      • memory/916-64-0x000000006F740000-0x000000006FCEB000-memory.dmp
                        Filesize

                        5.7MB

                        Download
                      • memory/916-65-0x000000006F740000-0x000000006FCEB000-memory.dmp
                        Filesize

                        5.7MB

                        Download
                      • memory/916-66-0x000000006F740000-0x000000006FCEB000-memory.dmp
                        Filesize

                        5.7MB

                        Download
                      • memory/1388-56-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1388-58-0x00000000716B0000-0x0000000071C5B000-memory.dmp
                        Filesize

                        5.7MB

                        Download
                      • memory/1388-59-0x00000000716B0000-0x0000000071C5B000-memory.dmp
                        Filesize

                        5.7MB

                        Download
                      • memory/1960-54-0x0000000000370000-0x00000000007B4000-memory.dmp
                        Filesize

                        4.3MB

                        Download
                      • memory/1960-55-0x0000000075451000-0x0000000075453000-memory.dmp
                        Filesize

                        8KB

                        Download
                      • memory/1960-60-0x0000000005CB0000-0x0000000005FE6000-memory.dmp
                        Filesize

                        3.2MB

                        Download