8ac5f5cbd3af833da480c3a66e6e1bc4417a97864e36b723299a0b8eb5a15f2a

Analysis

max time kernel
202s
max time network
253s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Comprovante Transacional_HTML.exe
Size

911KB
MD5

e78a58a675ff24e3865bdbf3e313daf8
SHA1

e12f7df0d31c560c276a880dd8b4cabc4154d0a3
SHA256

4b37b1ed0345fa62aaf25247b5c47d5812ef522e1a215d815a8b4d0393dea899
SHA512

2d398ab4fa9541cc7efe2ba3a472e7a6821cdbf9c1652d4f4148e1ed1579de19872c7ed1ab87270dcdcb8b4c0f3649d70d1d7d600082328ec58bb15fcdaec544
SSDEEP

24576:R4lavt0LkLL9IMixoEgeam8gpOi1pq9MmCS:gkwkn9IMHeamf9jaPCS

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Comprovante Transacional_HTML.exe

pid process

5084 Comprovante Transacional_HTML.exe

pid	process
5084	Comprovante Transacional_HTML.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Comprovante Transacional_HTML.exe

description pid process target process

PID 1420 set thread context of 5084 1420 Comprovante Transacional_HTML.exe Comprovante Transacional_HTML.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1420 set thread context of 5084	1420	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe

NTFS ADS 1 IoCs

Processes:

Comprovante Transacional_HTML.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe:Zone.Identifier:$DATA	Comprovante Transacional_HTML.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Comprovante Transacional_HTML.exe

pid process

1420 Comprovante Transacional_HTML.exe
1420 Comprovante Transacional_HTML.exe

pid	process
1420	Comprovante Transacional_HTML.exe
1420	Comprovante Transacional_HTML.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Comprovante Transacional_HTML.exe

description	pid	process	target process
PID 1420 wrote to memory of 5084	1420	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe
PID 1420 wrote to memory of 5084	1420	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe
PID 1420 wrote to memory of 5084	1420	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe
PID 1420 wrote to memory of 5084	1420	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe
PID 1420 wrote to memory of 5084	1420	Comprovante Transacional_HTML.exe	Comprovante Transacional_HTML.exe

C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe
"C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe"
1⤵
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1420

C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe
"C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe"
2⤵
- Executes dropped EXE
PID:5084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Comprovante Transacional_HTML.exe

Filesize
911KB

MD5
e78a58a675ff24e3865bdbf3e313daf8

SHA1
e12f7df0d31c560c276a880dd8b4cabc4154d0a3

SHA256
4b37b1ed0345fa62aaf25247b5c47d5812ef522e1a215d815a8b4d0393dea899

SHA512
2d398ab4fa9541cc7efe2ba3a472e7a6821cdbf9c1652d4f4148e1ed1579de19872c7ed1ab87270dcdcb8b4c0f3649d70d1d7d600082328ec58bb15fcdaec544

Download Submit
memory/5084-132-0x0000000000000000-mapping.dmp

Download
memory/5084-133-0x0000000000540000-0x0000000000560000-memory.dmp

Filesize
128KB

Download
memory/5084-135-0x0000000000540000-0x0000000000560000-memory.dmp

Filesize
128KB

Download
memory/5084-136-0x0000000000540000-0x0000000000560000-memory.dmp

Filesize
128KB

Download
memory/5084-137-0x0000000000540000-0x0000000000560000-memory.dmp

Filesize
128KB

Download
memory/5084-138-0x0000000000540000-0x0000000000560000-memory.dmp

Filesize
128KB

Download