Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 17:28
Static task
static1
Behavioral task
behavioral1
Sample
CONFIRMACIÓN DEL PEDIDO CVE810654.exe
Resource
win7-20220812-en
General
-
Target
CONFIRMACIÓN DEL PEDIDO CVE810654.exe
-
Size
202KB
-
MD5
e4cbdbd1fb5e7d1fcf3f08050ffe2d6a
-
SHA1
e1b978f2c29be0e31873c09336fe23032ff59b22
-
SHA256
bb62ecac5c56b6155fa01cb00438aba8bb2c0bcfd39a71acf92728ce8bf328d0
-
SHA512
efac2588ba1aca1c9737f258861a72e47f09e7bf9649638efe3d3ed350ed9dd19d95dfea22c37fa09e9d164a3c25aef9cef155f649b96132231ea3d5930524e9
-
SSDEEP
3072:8wf065+tl8PteWa50X714vwtW44XX6AM53TSoH86CCNH0/2jMujgfPYF4SSojq2w:8G0xkvef6C2U/2afg9jBnq
Malware Config
Extracted
nanocore
1.2.2.0
albertsamco76.ddns.net:7480
79.134.225.71:7480
595ac7be-87a8-4935-8bed-199af086cae8
-
activate_away_mode
true
-
backup_connection_host
79.134.225.71
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-07-15T18:29:52.126272236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
5000
-
connection_port
7480
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
595ac7be-87a8-4935-8bed-199af086cae8
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
albertsamco76.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
CONFIRMACIÓN DEL PEDIDO CVE810654.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe" CONFIRMACIÓN DEL PEDIDO CVE810654.exe -
Processes:
CONFIRMACIÓN DEL PEDIDO CVE810654.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CONFIRMACIÓN DEL PEDIDO CVE810654.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
CONFIRMACIÓN DEL PEDIDO CVE810654.exedescription pid process target process PID 736 set thread context of 2180 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe -
Drops file in Program Files directory 2 IoCs
Processes:
CONFIRMACIÓN DEL PEDIDO CVE810654.exedescription ioc process File created C:\Program Files (x86)\DDP Manager\ddpmgr.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe File opened for modification C:\Program Files (x86)\DDP Manager\ddpmgr.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4228 schtasks.exe 1104 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
CONFIRMACIÓN DEL PEDIDO CVE810654.exeCONFIRMACIÓN DEL PEDIDO CVE810654.exepid process 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
CONFIRMACIÓN DEL PEDIDO CVE810654.exepid process 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
CONFIRMACIÓN DEL PEDIDO CVE810654.exeCONFIRMACIÓN DEL PEDIDO CVE810654.exedescription pid process Token: SeDebugPrivilege 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe Token: SeDebugPrivilege 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
CONFIRMACIÓN DEL PEDIDO CVE810654.exeCONFIRMACIÓN DEL PEDIDO CVE810654.exedescription pid process target process PID 736 wrote to memory of 1328 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe PID 736 wrote to memory of 1328 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe PID 736 wrote to memory of 1328 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe PID 736 wrote to memory of 2180 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe PID 736 wrote to memory of 2180 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe PID 736 wrote to memory of 2180 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe PID 736 wrote to memory of 2180 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe PID 736 wrote to memory of 2180 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe PID 736 wrote to memory of 2180 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe PID 736 wrote to memory of 2180 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe PID 736 wrote to memory of 2180 736 CONFIRMACIÓN DEL PEDIDO CVE810654.exe CONFIRMACIÓN DEL PEDIDO CVE810654.exe PID 2180 wrote to memory of 4228 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe schtasks.exe PID 2180 wrote to memory of 4228 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe schtasks.exe PID 2180 wrote to memory of 4228 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe schtasks.exe PID 2180 wrote to memory of 1104 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe schtasks.exe PID 2180 wrote to memory of 1104 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe schtasks.exe PID 2180 wrote to memory of 1104 2180 CONFIRMACIÓN DEL PEDIDO CVE810654.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CONFIRMACIÓN DEL PEDIDO CVE810654.exe"C:\Users\Admin\AppData\Local\Temp\CONFIRMACIÓN DEL PEDIDO CVE810654.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\CONFIRMACIÓN DEL PEDIDO CVE810654.exe"C:\Users\Admin\AppData\Local\Temp\CONFIRMACIÓN DEL PEDIDO CVE810654.exe"2⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\CONFIRMACIÓN DEL PEDIDO CVE810654.exe"C:\Users\Admin\AppData\Local\Temp\CONFIRMACIÓN DEL PEDIDO CVE810654.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp81E2.tmp"3⤵
- Creates scheduled task(s)
PID:4228 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8619.tmp"3⤵
- Creates scheduled task(s)
PID:1104
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55426741e0578a448190f8738e4ab22b5
SHA10400ee2dce355b1262cf630ada5a9a0f45c52a1c
SHA25697c6691907a6918da654bf9c856b974c83d7f55ef233df63cb4ef5aaeacc51e7
SHA512a22f7b8b207347787ee007bacc5dda0bf3e12442d23f7096cb20b2c535f5d62c9c98b450d1b67221d2f0cb814163a67c9db00eaf3c1ec5c2d307bf04e0addd80
-
Filesize
1KB
MD5677848190631e19222304d1982aa2e1b
SHA1bed6cf97d3458e4ea59ff9823375d915a9b3d682
SHA2568bcf16c788d228932fa707bb4250c05151e099bdf7040adc717e53680601be3d
SHA512f5d41e150011bc63f4c95799e21fe91ffaa25eb05f4ca46ea89f3a3ca5325413ba4e0b7b5d69c0bc189955f3308c4928016a7cc1d6f7c2352639106952e92b1e