Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2022 16:47
Static task
static1
Behavioral task
behavioral1
Sample
Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe
Resource
win10v2004-20220812-en
General
-
Target
Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe
-
Size
3.2MB
-
MD5
bc350e8ec68185dca18aca4c6d774f4b
-
SHA1
2a7e884eae9a14f2583e41ce3fe4f0e32d47e0bc
-
SHA256
351237effe536fd82440d7925eff69ab1d779f226f877c7b2c592b0b0480f5ee
-
SHA512
ca7d322987d0680b2b2af844e57f368aa7dabbe2b2787a75d4965c50589521722d1ade561c0bdd20ed8fe812a309eb19967c5385e54109557f55e2dd085c2677
-
SSDEEP
98304:3lCI7fHrtFkwdYX4kBmyK/4FPQYbIQ3J5Wp:3ltLMwWnp24FP7f
Malware Config
Extracted
bitrat
1.38
pedroleonta822.con-ip.com:5020
-
communication_password
202cb962ac59075b964b07152d234b70
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4320-145-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4320-146-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4320-147-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4320-148-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4320-149-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4320-152-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ljqcjwv\\chrome.exe\"" Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
InstallUtil.exepid process 4320 InstallUtil.exe 4320 InstallUtil.exe 4320 InstallUtil.exe 4320 InstallUtil.exe 4320 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exedescription pid process target process PID 3300 set thread context of 4320 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exeComprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exepid process 2560 powershell.exe 2560 powershell.exe 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe Token: SeDebugPrivilege 2560 powershell.exe Token: SeShutdownPrivilege 4320 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exepid process 4320 InstallUtil.exe 4320 InstallUtil.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exedescription pid process target process PID 3300 wrote to memory of 2560 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe powershell.exe PID 3300 wrote to memory of 2560 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe powershell.exe PID 3300 wrote to memory of 2560 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe powershell.exe PID 3300 wrote to memory of 3740 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe PID 3300 wrote to memory of 3740 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe PID 3300 wrote to memory of 3740 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe PID 3300 wrote to memory of 4008 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe PID 3300 wrote to memory of 4008 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe PID 3300 wrote to memory of 4008 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe PID 3300 wrote to memory of 4320 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe PID 3300 wrote to memory of 4320 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe PID 3300 wrote to memory of 4320 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe PID 3300 wrote to memory of 4320 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe PID 3300 wrote to memory of 4320 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe PID 3300 wrote to memory of 4320 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe PID 3300 wrote to memory of 4320 3300 Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe"C:\Users\Admin\AppData\Local\Temp\Comprob. DEPOSITO EN EFECTIVO cancelacion de FA-927347295424.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2560-134-0x0000000000000000-mapping.dmp
-
memory/2560-135-0x0000000005220000-0x0000000005256000-memory.dmpFilesize
216KB
-
memory/2560-136-0x0000000005960000-0x0000000005F88000-memory.dmpFilesize
6.2MB
-
memory/2560-137-0x00000000060F0000-0x0000000006156000-memory.dmpFilesize
408KB
-
memory/2560-138-0x00000000061D0000-0x0000000006236000-memory.dmpFilesize
408KB
-
memory/2560-139-0x00000000067F0000-0x000000000680E000-memory.dmpFilesize
120KB
-
memory/2560-140-0x0000000007FF0000-0x000000000866A000-memory.dmpFilesize
6.5MB
-
memory/2560-141-0x0000000006CE0000-0x0000000006CFA000-memory.dmpFilesize
104KB
-
memory/3300-132-0x0000000000510000-0x0000000000840000-memory.dmpFilesize
3.2MB
-
memory/3300-133-0x00000000053B0000-0x00000000053D2000-memory.dmpFilesize
136KB
-
memory/3740-142-0x0000000000000000-mapping.dmp
-
memory/4008-143-0x0000000000000000-mapping.dmp
-
memory/4320-144-0x0000000000000000-mapping.dmp
-
memory/4320-145-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4320-146-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4320-147-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4320-148-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4320-149-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4320-150-0x0000000075080000-0x00000000750B9000-memory.dmpFilesize
228KB
-
memory/4320-151-0x0000000075400000-0x0000000075439000-memory.dmpFilesize
228KB
-
memory/4320-152-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4320-153-0x0000000075080000-0x00000000750B9000-memory.dmpFilesize
228KB
-
memory/4320-154-0x0000000075400000-0x0000000075439000-memory.dmpFilesize
228KB