Analysis
-
max time kernel
181s -
max time network
210s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
13-12-2022 22:45
Static task
static1
Behavioral task
behavioral1
Sample
PEDIDO 035 pdf.exe
Resource
win7-20221111-en
General
-
Target
PEDIDO 035 pdf.exe
-
Size
947KB
-
MD5
8af2df525a8683404955d23109e7cc9d
-
SHA1
a823a9411db0121dd94ebdafa39ebca8d4dce5ea
-
SHA256
082215d9272c7f706e6cc3b5f75abaa5e264566c1f6dec9fd0cd770d4bd86b4b
-
SHA512
b87743cee0c81a8d83f2c2cabea1e93a39b1ae75c68868c5161266be0b8c03777551fb7043382e7b05af632fd126455889ce4841f89b44559ecfc5d51cf96a0a
-
SSDEEP
24576:Y94yl9weJIiPpgwQDbRgOEsiwwdBhZmBHMe:5y3wYhgwQrEDjdBhSHH
Malware Config
Extracted
formbook
asdo
31/RFVD/FFkpCuo=
LS2evkT1Hf54yJ3A01ZhjLFKSw==
Dw25w8eoM4HRQ9T8YA==
F2rI9TgH1uCf
VOuuxD/qTPifG/QDJ76coQ==
9smUEHwvvAcD3rnTM3IZg7fh
k4RlZq6jXYrfEg==
1+E7QsiGloB8qoio4Oh/
dALS/H0nMg+jCtM1RpZ+
thNv9GMouDLIFvESJ76coQ==
Tc54uifIU66mck2hvrtXnVbp
cINUAYgiqlkpCuo=
ma2AwPyPmpxd2bPRMksak0T7uEg9kA==
RlMlYJ9UpFIz7dg1RpZ+
klG+mNmHrHcFhmZ12SNGhmN+0f6MaMs=
V/nT2VgHD+hito+tBumEzTyVl5g=
0Zto8FjseN7v8MAW6ZkZg7fh
gbGlkddlXYrfEg==
pymXGHouvjhnKg8+qD8bLcY=
VelU01Tk/+CzegtywL4=
beu8i8uQo444B/I=
l1M5dadWfFDeV+s9sqk=
/dYkHYIfGV7iGA==
yI9kAZU8sDb2xrLNME4qL1L8A1UDR0OUTA==
Kfe3Bk7moSq5R+T9SYR9qQ==
qOu+wD/TXqzjQ9T8YA==
gwj+jqGpw1nLC/0=
AossQ3UoIIdVQaw8Qrt39kyJVA==
8LSKJa5YfmQ89cT/ecbD8xsqqOY2WJHY
0B3g3lkKOCTyMP4Y
wsAuMK9S5GDVQ9T8YA==
MWg6ADHDUNx798o1RpZ+
+72b1gyswJlV+Nc1RpZ+
Sw3lduGKXYrfEg==
80+uIIs4wk0fHfc=
pD8e4SDKUbj08LYZJnmGrg==
xxTq1hvSAQGl6Nf8PpOhCN12a4U=
YqmMV6xd71Cj38P0TZSIzjyVl5g=
dvNQ4FX8oersPiFXxNd2
LQfLIFcA+NFGmnSu/Wd6s03ye5CxR0OUTA==
qwNh7W8Yp1kpCuo=
BVci+UD6CS+lIfca
EAPiDT3fBA7wuI28CTu0J9E=
cLWLnh7W7vPyMP4Y
AIvnULNVyjd7rUx3wbw=
4eNBGEvs69ru8Lz+J76coQ==
xij4yO2DJIbQQ9T8YA==
DtnMDfkH1uCf
Vdm1hqpJVmckmGyb+xHn6yvMWKdbtz/X
6suQ4TbR5PHHaTNdwBoyUXqbrulBPsU=
iUJfoPR8XYrfEg==
1dg8GFYOGfbyMP4Y
jJZbru2GpG/VQ9T8YA==
BYtrRoA53ixudFOW/ju0J9E=
t0YlD4JO+WejmX6b7Du0J9E=
SBd2efu0XOnu/+g=
lSmLCnwmxiAe/MvoOVYzPjyVl5g=
BhFhVLlkzKEOQ9T8YA==
HeW78yHca87Xtpy7GGFep077uEg9kA==
aTobtETW3LLDMhpFkItevrdLQw==
laVzGpVKyTx+bQtywL4=
QDubmhTJgQ0OHvc=
K6PvmaTA4K0TQ9T8YA==
5/FSIl39tjnJF/ISJ76coQ==
somosterraingenieria.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PEDIDO 035 pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation PEDIDO 035 pdf.exe -
Loads dropped DLL 1 IoCs
Processes:
wininit.exepid process 1696 wininit.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PEDIDO 035 pdf.exePEDIDO 035 pdf.exewininit.exedescription pid process target process PID 1132 set thread context of 468 1132 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 468 set thread context of 1248 468 PEDIDO 035 pdf.exe Explorer.EXE PID 468 set thread context of 1248 468 PEDIDO 035 pdf.exe Explorer.EXE PID 1696 set thread context of 1248 1696 wininit.exe Explorer.EXE -
Processes:
wininit.exedescription ioc process Key created \Registry\User\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wininit.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
PEDIDO 035 pdf.exewininit.exepid process 468 PEDIDO 035 pdf.exe 468 PEDIDO 035 pdf.exe 468 PEDIDO 035 pdf.exe 468 PEDIDO 035 pdf.exe 468 PEDIDO 035 pdf.exe 1696 wininit.exe 1696 wininit.exe 1696 wininit.exe 1696 wininit.exe 1696 wininit.exe 1696 wininit.exe 1696 wininit.exe 1696 wininit.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
PEDIDO 035 pdf.exewininit.exepid process 468 PEDIDO 035 pdf.exe 468 PEDIDO 035 pdf.exe 468 PEDIDO 035 pdf.exe 468 PEDIDO 035 pdf.exe 1696 wininit.exe 1696 wininit.exe 1696 wininit.exe 1696 wininit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PEDIDO 035 pdf.exewininit.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 468 PEDIDO 035 pdf.exe Token: SeDebugPrivilege 1696 wininit.exe Token: SeShutdownPrivilege 1248 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
PEDIDO 035 pdf.exeExplorer.EXEwininit.exedescription pid process target process PID 1132 wrote to memory of 468 1132 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 1132 wrote to memory of 468 1132 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 1132 wrote to memory of 468 1132 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 1132 wrote to memory of 468 1132 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 1132 wrote to memory of 468 1132 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 1132 wrote to memory of 468 1132 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 1132 wrote to memory of 468 1132 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 1248 wrote to memory of 1696 1248 Explorer.EXE wininit.exe PID 1248 wrote to memory of 1696 1248 Explorer.EXE wininit.exe PID 1248 wrote to memory of 1696 1248 Explorer.EXE wininit.exe PID 1248 wrote to memory of 1696 1248 Explorer.EXE wininit.exe PID 1696 wrote to memory of 1728 1696 wininit.exe Firefox.exe PID 1696 wrote to memory of 1728 1696 wininit.exe Firefox.exe PID 1696 wrote to memory of 1728 1696 wininit.exe Firefox.exe PID 1696 wrote to memory of 1728 1696 wininit.exe Firefox.exe PID 1696 wrote to memory of 1728 1696 wininit.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\PEDIDO 035 pdf.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO 035 pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\PEDIDO 035 pdf.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO 035 pdf.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:468 -
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1728
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
770KB
MD565f6090dfb069aca962a59f6df9e6113
SHA1879bad504dfcce1a591c97817f3ff1e63931cfd2
SHA25632a302d8c235226d8cdda4d957f151df3e5736fdce7886e6c794f0648b2eb106
SHA5124c0e5e1103749356dceaaaa312e853bda83ec14f2f12288e9020cdf42b6e80d4caaec03d1ef7f34d81ddf2da88e6160c0c711380c2a7d89012e660406cdbb987
-
memory/468-68-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/468-69-0x0000000000C60000-0x0000000000F63000-memory.dmpFilesize
3.0MB
-
memory/468-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/468-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/468-64-0x00000000004012B0-mapping.dmp
-
memory/468-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/468-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/468-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/468-77-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/468-73-0x00000000001A0000-0x00000000001B0000-memory.dmpFilesize
64KB
-
memory/468-70-0x0000000000070000-0x0000000000080000-memory.dmpFilesize
64KB
-
memory/468-76-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1132-57-0x0000000000310000-0x000000000031E000-memory.dmpFilesize
56KB
-
memory/1132-54-0x0000000000B60000-0x0000000000C52000-memory.dmpFilesize
968KB
-
memory/1132-58-0x00000000051A0000-0x0000000005210000-memory.dmpFilesize
448KB
-
memory/1132-56-0x00000000002E0000-0x0000000000302000-memory.dmpFilesize
136KB
-
memory/1132-55-0x0000000075E81000-0x0000000075E83000-memory.dmpFilesize
8KB
-
memory/1132-59-0x0000000000860000-0x0000000000894000-memory.dmpFilesize
208KB
-
memory/1248-71-0x00000000066B0000-0x00000000067CE000-memory.dmpFilesize
1.1MB
-
memory/1248-82-0x00000000039E0000-0x0000000003A73000-memory.dmpFilesize
588KB
-
memory/1248-83-0x0000000006AE0000-0x0000000006C0D000-memory.dmpFilesize
1.2MB
-
memory/1248-86-0x00000000039E0000-0x0000000003A73000-memory.dmpFilesize
588KB
-
memory/1248-74-0x0000000006AE0000-0x0000000006C0D000-memory.dmpFilesize
1.2MB
-
memory/1696-75-0x0000000000000000-mapping.dmp
-
memory/1696-78-0x0000000000CB0000-0x0000000000CCA000-memory.dmpFilesize
104KB
-
memory/1696-79-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1696-80-0x00000000020D0000-0x00000000023D3000-memory.dmpFilesize
3.0MB
-
memory/1696-81-0x00000000004A0000-0x000000000052F000-memory.dmpFilesize
572KB
-
memory/1696-84-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB