Analysis
-
max time kernel
187s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2022 22:45
Static task
static1
Behavioral task
behavioral1
Sample
PEDIDO 035 pdf.exe
Resource
win7-20221111-en
General
-
Target
PEDIDO 035 pdf.exe
-
Size
947KB
-
MD5
8af2df525a8683404955d23109e7cc9d
-
SHA1
a823a9411db0121dd94ebdafa39ebca8d4dce5ea
-
SHA256
082215d9272c7f706e6cc3b5f75abaa5e264566c1f6dec9fd0cd770d4bd86b4b
-
SHA512
b87743cee0c81a8d83f2c2cabea1e93a39b1ae75c68868c5161266be0b8c03777551fb7043382e7b05af632fd126455889ce4841f89b44559ecfc5d51cf96a0a
-
SSDEEP
24576:Y94yl9weJIiPpgwQDbRgOEsiwwdBhZmBHMe:5y3wYhgwQrEDjdBhSHH
Malware Config
Extracted
formbook
asdo
31/RFVD/FFkpCuo=
LS2evkT1Hf54yJ3A01ZhjLFKSw==
Dw25w8eoM4HRQ9T8YA==
F2rI9TgH1uCf
VOuuxD/qTPifG/QDJ76coQ==
9smUEHwvvAcD3rnTM3IZg7fh
k4RlZq6jXYrfEg==
1+E7QsiGloB8qoio4Oh/
dALS/H0nMg+jCtM1RpZ+
thNv9GMouDLIFvESJ76coQ==
Tc54uifIU66mck2hvrtXnVbp
cINUAYgiqlkpCuo=
ma2AwPyPmpxd2bPRMksak0T7uEg9kA==
RlMlYJ9UpFIz7dg1RpZ+
klG+mNmHrHcFhmZ12SNGhmN+0f6MaMs=
V/nT2VgHD+hito+tBumEzTyVl5g=
0Zto8FjseN7v8MAW6ZkZg7fh
gbGlkddlXYrfEg==
pymXGHouvjhnKg8+qD8bLcY=
VelU01Tk/+CzegtywL4=
beu8i8uQo444B/I=
l1M5dadWfFDeV+s9sqk=
/dYkHYIfGV7iGA==
yI9kAZU8sDb2xrLNME4qL1L8A1UDR0OUTA==
Kfe3Bk7moSq5R+T9SYR9qQ==
qOu+wD/TXqzjQ9T8YA==
gwj+jqGpw1nLC/0=
AossQ3UoIIdVQaw8Qrt39kyJVA==
8LSKJa5YfmQ89cT/ecbD8xsqqOY2WJHY
0B3g3lkKOCTyMP4Y
wsAuMK9S5GDVQ9T8YA==
MWg6ADHDUNx798o1RpZ+
+72b1gyswJlV+Nc1RpZ+
Sw3lduGKXYrfEg==
80+uIIs4wk0fHfc=
pD8e4SDKUbj08LYZJnmGrg==
xxTq1hvSAQGl6Nf8PpOhCN12a4U=
YqmMV6xd71Cj38P0TZSIzjyVl5g=
dvNQ4FX8oersPiFXxNd2
LQfLIFcA+NFGmnSu/Wd6s03ye5CxR0OUTA==
qwNh7W8Yp1kpCuo=
BVci+UD6CS+lIfca
EAPiDT3fBA7wuI28CTu0J9E=
cLWLnh7W7vPyMP4Y
AIvnULNVyjd7rUx3wbw=
4eNBGEvs69ru8Lz+J76coQ==
xij4yO2DJIbQQ9T8YA==
DtnMDfkH1uCf
Vdm1hqpJVmckmGyb+xHn6yvMWKdbtz/X
6suQ4TbR5PHHaTNdwBoyUXqbrulBPsU=
iUJfoPR8XYrfEg==
1dg8GFYOGfbyMP4Y
jJZbru2GpG/VQ9T8YA==
BYtrRoA53ixudFOW/ju0J9E=
t0YlD4JO+WejmX6b7Du0J9E=
SBd2efu0XOnu/+g=
lSmLCnwmxiAe/MvoOVYzPjyVl5g=
BhFhVLlkzKEOQ9T8YA==
HeW78yHca87Xtpy7GGFep077uEg9kA==
aTobtETW3LLDMhpFkItevrdLQw==
laVzGpVKyTx+bQtywL4=
QDubmhTJgQ0OHvc=
K6PvmaTA4K0TQ9T8YA==
5/FSIl39tjnJF/ISJ76coQ==
somosterraingenieria.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PEDIDO 035 pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation PEDIDO 035 pdf.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PEDIDO 035 pdf.exePEDIDO 035 pdf.exesystray.exedescription pid process target process PID 2708 set thread context of 1744 2708 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 1744 set thread context of 2808 1744 PEDIDO 035 pdf.exe Explorer.EXE PID 2692 set thread context of 2808 2692 systray.exe Explorer.EXE -
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
PEDIDO 035 pdf.exesystray.exepid process 1744 PEDIDO 035 pdf.exe 1744 PEDIDO 035 pdf.exe 1744 PEDIDO 035 pdf.exe 1744 PEDIDO 035 pdf.exe 1744 PEDIDO 035 pdf.exe 1744 PEDIDO 035 pdf.exe 1744 PEDIDO 035 pdf.exe 1744 PEDIDO 035 pdf.exe 2692 systray.exe 2692 systray.exe 2692 systray.exe 2692 systray.exe 2692 systray.exe 2692 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2808 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PEDIDO 035 pdf.exesystray.exepid process 1744 PEDIDO 035 pdf.exe 1744 PEDIDO 035 pdf.exe 1744 PEDIDO 035 pdf.exe 2692 systray.exe 2692 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PEDIDO 035 pdf.exesystray.exedescription pid process Token: SeDebugPrivilege 1744 PEDIDO 035 pdf.exe Token: SeDebugPrivilege 2692 systray.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
PEDIDO 035 pdf.exeExplorer.EXEdescription pid process target process PID 2708 wrote to memory of 1744 2708 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 2708 wrote to memory of 1744 2708 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 2708 wrote to memory of 1744 2708 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 2708 wrote to memory of 1744 2708 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 2708 wrote to memory of 1744 2708 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 2708 wrote to memory of 1744 2708 PEDIDO 035 pdf.exe PEDIDO 035 pdf.exe PID 2808 wrote to memory of 2692 2808 Explorer.EXE systray.exe PID 2808 wrote to memory of 2692 2808 Explorer.EXE systray.exe PID 2808 wrote to memory of 2692 2808 Explorer.EXE systray.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PEDIDO 035 pdf.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO 035 pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PEDIDO 035 pdf.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO 035 pdf.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1744-144-0x0000000000F10000-0x0000000000F20000-memory.dmpFilesize
64KB
-
memory/1744-142-0x0000000001380000-0x00000000016CA000-memory.dmpFilesize
3.3MB
-
memory/1744-148-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1744-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1744-141-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1744-137-0x0000000000000000-mapping.dmp
-
memory/1744-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1744-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2692-150-0x0000000000FB0000-0x0000000000FDD000-memory.dmpFilesize
180KB
-
memory/2692-152-0x0000000002FB0000-0x000000000303F000-memory.dmpFilesize
572KB
-
memory/2692-154-0x0000000000FB0000-0x0000000000FDD000-memory.dmpFilesize
180KB
-
memory/2692-146-0x0000000000000000-mapping.dmp
-
memory/2692-151-0x0000000003150000-0x000000000349A000-memory.dmpFilesize
3.3MB
-
memory/2692-149-0x00000000009C0000-0x00000000009C6000-memory.dmpFilesize
24KB
-
memory/2708-135-0x0000000005270000-0x000000000527A000-memory.dmpFilesize
40KB
-
memory/2708-133-0x0000000005790000-0x0000000005D34000-memory.dmpFilesize
5.6MB
-
memory/2708-136-0x0000000006250000-0x00000000062EC000-memory.dmpFilesize
624KB
-
memory/2708-134-0x0000000005280000-0x0000000005312000-memory.dmpFilesize
584KB
-
memory/2708-132-0x00000000007E0000-0x00000000008D2000-memory.dmpFilesize
968KB
-
memory/2808-145-0x0000000002E20000-0x0000000002F1D000-memory.dmpFilesize
1012KB
-
memory/2808-153-0x0000000003150000-0x0000000003204000-memory.dmpFilesize
720KB
-
memory/2808-155-0x0000000003150000-0x0000000003204000-memory.dmpFilesize
720KB