8ac5f5cbd3af833da480c3a66e6e1bc4417a97864e36b723299a0b8eb5a15f2a

Analysis

max time kernel
71s
max time network
114s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Comprovante Transacional_HTML.exe
Size

911KB
MD5

e78a58a675ff24e3865bdbf3e313daf8
SHA1

e12f7df0d31c560c276a880dd8b4cabc4154d0a3
SHA256

4b37b1ed0345fa62aaf25247b5c47d5812ef522e1a215d815a8b4d0393dea899
SHA512

2d398ab4fa9541cc7efe2ba3a472e7a6821cdbf9c1652d4f4148e1ed1579de19872c7ed1ab87270dcdcb8b4c0f3649d70d1d7d600082328ec58bb15fcdaec544
SSDEEP

24576:R4lavt0LkLL9IMixoEgeam8gpOi1pq9MmCS:gkwkn9IMHeamf9jaPCS

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Comprovante Transacional_HTML.exe

pid process

712 Comprovante Transacional_HTML.exe
Loads dropped DLL 1 IoCs

Processes:

Comprovante Transacional_HTML.exe

pid process

632 Comprovante Transacional_HTML.exe

pid	process
712	Comprovante Transacional_HTML.exe

pid	process
632	Comprovante Transacional_HTML.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Comprovante Transacional_HTML.exe

description pid process target process

PID 632 set thread context of 712 632 Comprovante Transacional_HTML.exe Comprovante Transacional_HTML.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 632 set thread context of 712	632	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe

NTFS ADS 1 IoCs

Processes:

Comprovante Transacional_HTML.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe:Zone.Identifier:$DATA	Comprovante Transacional_HTML.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Comprovante Transacional_HTML.exe

pid process

632 Comprovante Transacional_HTML.exe

pid	process
632	Comprovante Transacional_HTML.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Comprovante Transacional_HTML.exe

description	pid	process	target process
PID 632 wrote to memory of 712	632	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe
PID 632 wrote to memory of 712	632	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe
PID 632 wrote to memory of 712	632	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe
PID 632 wrote to memory of 712	632	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe
PID 632 wrote to memory of 712	632	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe
PID 632 wrote to memory of 712	632	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe

C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe
"C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:632

C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe
"C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe"
2⤵
- Executes dropped EXE
PID:712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe
Filesize
911KB

MD5
e78a58a675ff24e3865bdbf3e313daf8

SHA1
e12f7df0d31c560c276a880dd8b4cabc4154d0a3

SHA256
4b37b1ed0345fa62aaf25247b5c47d5812ef522e1a215d815a8b4d0393dea899

SHA512
2d398ab4fa9541cc7efe2ba3a472e7a6821cdbf9c1652d4f4148e1ed1579de19872c7ed1ab87270dcdcb8b4c0f3649d70d1d7d600082328ec58bb15fcdaec544

Download Submit
\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe
Filesize
911KB

MD5
e78a58a675ff24e3865bdbf3e313daf8

SHA1
e12f7df0d31c560c276a880dd8b4cabc4154d0a3

SHA256
4b37b1ed0345fa62aaf25247b5c47d5812ef522e1a215d815a8b4d0393dea899

SHA512
2d398ab4fa9541cc7efe2ba3a472e7a6821cdbf9c1652d4f4148e1ed1579de19872c7ed1ab87270dcdcb8b4c0f3649d70d1d7d600082328ec58bb15fcdaec544

Download Submit
memory/632-54-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/712-56-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/712-58-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/712-59-0x000000000009228C-mapping.dmp

Download
memory/712-61-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/712-63-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/712-64-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/712-65-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download