Analysis
- max time kernel
130s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
08/09/2022, 05:13
Static task
static1
Behavioral task
behavioral1
Sample
FichaReembolso.cmd
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
FichaReembolso.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target FichaReembolso.cmd
- Size 1.3MB
- Sample220908-fwmemaahaj
- SHA256 1f42fcd0060ea1cd970a998dd6d8588e38975045a0b4ffe8bad383711498fbc6
- MD5 79e6d5064d068858a1a0a588f4bc1f76
- SHA1 1b2ed5b0f4b63e24ce9fdfb3d56645e9cd9eab5a
- SHA512 33b7d4e893bc0b0cd9935f8b0aebd9acb9b43adb7c1a8ebb48119857fcd6296b6062a2e5d9e5f10275d2bfaa86973f1ccfa3d0953892b383c8c1f68f82bc1fa0
- SSDEEP 24576:I31wpEXwODAVkSnz3R/sOfRQEZZjEg6GEaeJu47fnpdRgaCQIAYhrz:TpzqABDBsA5Z4lLD0H9z
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 204 RINDI%xxxxx%.exe - Delays execution with timeout.exe 1 IoCs
pid Process 796 timeout.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2 RINDI%xxxxx%.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 852 WMIC.exe Token: SeSecurityPrivilege 852 WMIC.exe Token: SeTakeOwnershipPrivilege 852 WMIC.exe Token: SeLoadDriverPrivilege 852 WMIC.exe Token: SeSystemProfilePrivilege 852 WMIC.exe Token: SeSystemtimePrivilege 852 WMIC.exe Token: SeProfSingleProcessPrivilege 852 WMIC.exe Token: SeIncBasePriorityPrivilege 852 WMIC.exe Token: SeCreatePagefilePrivilege 852 WMIC.exe Token: SeBackupPrivilege 852 WMIC.exe Token: SeRestorePrivilege 852 WMIC.exe Token: SeShutdownPrivilege 852 WMIC.exe Token: SeDebugPrivilege 852 WMIC.exe Token: SeSystemEnvironmentPrivilege 852 WMIC.exe Token: SeRemoteShutdownPrivilege 852 WMIC.exe Token: SeUndockPrivilege 852 WMIC.exe Token: SeManageVolumePrivilege 852 WMIC.exe Token: 33 852 WMIC.exe Token: 34 852 WMIC.exe Token: 35 852 WMIC.exe Token: 36 852 WMIC.exe Token: SeIncreaseQuotaPrivilege 852 WMIC.exe Token: SeSecurityPrivilege 852 WMIC.exe Token: SeTakeOwnershipPrivilege 852 WMIC.exe Token: SeLoadDriverPrivilege 852 WMIC.exe Token: SeSystemProfilePrivilege 852 WMIC.exe Token: SeSystemtimePrivilege 852 WMIC.exe Token: SeProfSingleProcessPrivilege 852 WMIC.exe Token: SeIncBasePriorityPrivilege 852 WMIC.exe Token: SeCreatePagefilePrivilege 852 WMIC.exe Token: SeBackupPrivilege 852 WMIC.exe Token: SeRestorePrivilege 852 WMIC.exe Token: SeShutdownPrivilege 852 WMIC.exe Token: SeDebugPrivilege 852 WMIC.exe Token: SeSystemEnvironmentPrivilege 852 WMIC.exe Token: SeRemoteShutdownPrivilege 852 WMIC.exe Token: SeUndockPrivilege 852 WMIC.exe Token: SeManageVolumePrivilege 852 WMIC.exe Token: 33 852 WMIC.exe Token: 34 852 WMIC.exe Token: 35 852 WMIC.exe Token: 36 852 WMIC.exe - Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe - Suspicious use of SendNotifyMessage 10 IoCs
pid Process 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe 204 RINDI%xxxxx%.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3196 wrote to memory of 4396 3196 cmd.exe 24 PID 3196 wrote to memory of 4396 3196 cmd.exe 24 PID 4396 wrote to memory of 2112 4396 cmd.exe 23 PID 4396 wrote to memory of 2112 4396 cmd.exe 23 PID 4396 wrote to memory of 4240 4396 cmd.exe 44 PID 4396 wrote to memory of 4240 4396 cmd.exe 44 PID 4396 wrote to memory of 3392 4396 cmd.exe 58 PID 4396 wrote to memory of 3392 4396 cmd.exe 58 PID 4396 wrote to memory of 852 4396 cmd.exe 57 PID 4396 wrote to memory of 852 4396 cmd.exe 57 PID 4396 wrote to memory of 796 4396 cmd.exe 61 PID 4396 wrote to memory of 796 4396 cmd.exe 61
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FichaReembolso.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\FichaReembolso.cmd"2⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\system32\certutil.execertutil -decode -f ~~ "C:\Users\Admin\AppData\Roaming\jkjlhkj\exe\v3.3.14.5_20180315\RINDI%xxxxx%.exe"3⤵PID:4240
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process call create '"C:\Users\Admin\AppData\Roaming\jkjlhkj\exe\v3.3.14.5_20180315\RINDI%xxxxx%.exe" "C:\Users\Admin\AppData\Roaming\jkjlhkj\a3x\X2NI\FichaReembolso.a3x" ""' ,C:\Users\Admin\AppData\Local\Temp\3⤵
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
C:\Windows\system32\certutil.execertutil -decode -f C:\Users\Admin\AppData\Local\Temp\FichaReembolso.cmd "C:\Users\Admin\AppData\Roaming\jkjlhkj\a3x\X2NI\FichaReembolso.a3x"3⤵PID:3392
-
-
C:\Windows\system32\timeout.exetimeout /T 53⤵
- Delays execution with timeout.exe
PID:796
-
-
-
C:\Windows\system32\more.commore +5 C:\Users\Admin\AppData\Local\Temp\FichaReembolso.cmd1⤵PID:2112
-
C:\Users\Admin\AppData\Roaming\jkjlhkj\exe\v3.3.14.5_20180315\RINDI%xxxxx%.exe"C:\Users\Admin\AppData\Roaming\jkjlhkj\exe\v3.3.14.5_20180315\RINDI%xxxxx%.exe" "C:\Users\Admin\AppData\Roaming\jkjlhkj\a3x\X2NI\FichaReembolso.a3x" ""1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:204
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\~~
- Size 1.3MB
- SHA256 3a207a34910c4318a526fe189a14e3c10fe964e66859242e971d2372afbc1364
- MD5 66fee3830e23da28954e4491b0c3f9b2
- SHA1 8a6fca0e55e109c9a649622b1d7a034abf4c18b7
- SHA512 a5c372cc2b5c18a612224739de988f987df2caa42e87bcb2f628a2a6b91c49fab0360686cf5cac3d05a736e5c6899e60029ea7decf6addbfaafc671bcbb9c8c9
- SSDEEP 24576:OotxQMlJvzjVvWPsIFTwNat85B+OzGbfs6odtyq1WEReBCng0UxYf:zQCbjoZT85wKcNIhiOf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\jkjlhkj\a3x\X2NI\FichaReembolso.a3x
- Size 111KB
- SHA256 7382071007ef458d22b2fc27500369a3fa1785dbac209c121c2e522797ab7bd0
- MD5 78c5433f96819d8b95dddf6ecb40b21c
- SHA1 e9ae15dcc696f252851d82c7338364bd4c4bbe5e
- SHA512 9505ef1965f1c4c6981a28630fa028d15c4df18f5bca74457b39408ee816ed542bc7a9e7ef3f9aa8dbb1fa2c4c53748777df42df22f6b73873a01e4b9827067f
- SSDEEP 3072:J23w3LuvYgsX0/ybKMl3uMhyHTRb7+jvcrl8iIo:Q3w7uwg61uI3unzRb7acrl83o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\jkjlhkj\exe\V3314~1.5_2\RINDI%~1.EXE
- Size 872KB
- SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- MD5 c56b5f0201a3b3de53e561fe76912bfd
- SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\jkjlhkj\exe\v3.3.14.5_20180315\RINDI%xxxxx%.exe
- Size 872KB
- SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- MD5 c56b5f0201a3b3de53e561fe76912bfd
- SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
- MD5 SHA1 SHA512 SSDEEP