Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
20-12-2022 14:55
Static task
static1
Behavioral task
behavioral1
Sample
PEDIDO pdf.exe
Resource
win7-20220901-en
General
-
Target
PEDIDO pdf.exe
-
Size
752KB
-
MD5
e3698fc9d5c6152297de00168360d550
-
SHA1
eb53bcf6fd90162cc5b3d74fd018e6a981919c43
-
SHA256
26166c41b0a5364406a3c3f9c42d3f2bc3786aa5f32c71ee0675773bd7cc2125
-
SHA512
7c3c6c80fbda902fbde5ff554147852295d7c9508f4237ca3fba8ce03e7ae94cabb8d259f01dcd029036c5b7e845ac6c657a7638b5e9319ff66f6f298d9e55f2
-
SSDEEP
12288:mUdLctyTcf0hA/p4f2MjHJJY90LmRO1oTznmbhMGg3g43XR8:0UT40a/p4f2QLmEiTznmbvg3R3XR8
Malware Config
Extracted
formbook
asdo
31/RFVD/FFkpCuo=
LS2evkT1Hf54yJ3A01ZhjLFKSw==
Dw25w8eoM4HRQ9T8YA==
F2rI9TgH1uCf
VOuuxD/qTPifG/QDJ76coQ==
9smUEHwvvAcD3rnTM3IZg7fh
k4RlZq6jXYrfEg==
1+E7QsiGloB8qoio4Oh/
dALS/H0nMg+jCtM1RpZ+
thNv9GMouDLIFvESJ76coQ==
Tc54uifIU66mck2hvrtXnVbp
cINUAYgiqlkpCuo=
ma2AwPyPmpxd2bPRMksak0T7uEg9kA==
RlMlYJ9UpFIz7dg1RpZ+
klG+mNmHrHcFhmZ12SNGhmN+0f6MaMs=
V/nT2VgHD+hito+tBumEzTyVl5g=
0Zto8FjseN7v8MAW6ZkZg7fh
gbGlkddlXYrfEg==
pymXGHouvjhnKg8+qD8bLcY=
VelU01Tk/+CzegtywL4=
beu8i8uQo444B/I=
l1M5dadWfFDeV+s9sqk=
/dYkHYIfGV7iGA==
yI9kAZU8sDb2xrLNME4qL1L8A1UDR0OUTA==
Kfe3Bk7moSq5R+T9SYR9qQ==
qOu+wD/TXqzjQ9T8YA==
gwj+jqGpw1nLC/0=
AossQ3UoIIdVQaw8Qrt39kyJVA==
8LSKJa5YfmQ89cT/ecbD8xsqqOY2WJHY
0B3g3lkKOCTyMP4Y
wsAuMK9S5GDVQ9T8YA==
MWg6ADHDUNx798o1RpZ+
+72b1gyswJlV+Nc1RpZ+
Sw3lduGKXYrfEg==
80+uIIs4wk0fHfc=
pD8e4SDKUbj08LYZJnmGrg==
xxTq1hvSAQGl6Nf8PpOhCN12a4U=
YqmMV6xd71Cj38P0TZSIzjyVl5g=
dvNQ4FX8oersPiFXxNd2
LQfLIFcA+NFGmnSu/Wd6s03ye5CxR0OUTA==
qwNh7W8Yp1kpCuo=
BVci+UD6CS+lIfca
EAPiDT3fBA7wuI28CTu0J9E=
cLWLnh7W7vPyMP4Y
AIvnULNVyjd7rUx3wbw=
4eNBGEvs69ru8Lz+J76coQ==
xij4yO2DJIbQQ9T8YA==
DtnMDfkH1uCf
Vdm1hqpJVmckmGyb+xHn6yvMWKdbtz/X
6suQ4TbR5PHHaTNdwBoyUXqbrulBPsU=
iUJfoPR8XYrfEg==
1dg8GFYOGfbyMP4Y
jJZbru2GpG/VQ9T8YA==
BYtrRoA53ixudFOW/ju0J9E=
t0YlD4JO+WejmX6b7Du0J9E=
SBd2efu0XOnu/+g=
lSmLCnwmxiAe/MvoOVYzPjyVl5g=
BhFhVLlkzKEOQ9T8YA==
HeW78yHca87Xtpy7GGFep077uEg9kA==
aTobtETW3LLDMhpFkItevrdLQw==
laVzGpVKyTx+bQtywL4=
QDubmhTJgQ0OHvc=
K6PvmaTA4K0TQ9T8YA==
5/FSIl39tjnJF/ISJ76coQ==
somosterraingenieria.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PEDIDO pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation PEDIDO pdf.exe -
Loads dropped DLL 1 IoCs
Processes:
ipconfig.exepid process 596 ipconfig.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PEDIDO pdf.exePEDIDO pdf.exeipconfig.exedescription pid process target process PID 1348 set thread context of 1428 1348 PEDIDO pdf.exe PEDIDO pdf.exe PID 1428 set thread context of 1208 1428 PEDIDO pdf.exe Explorer.EXE PID 1428 set thread context of 1208 1428 PEDIDO pdf.exe Explorer.EXE PID 596 set thread context of 1208 596 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 596 ipconfig.exe -
Processes:
ipconfig.exedescription ioc process Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
PEDIDO pdf.exeipconfig.exepid process 1428 PEDIDO pdf.exe 1428 PEDIDO pdf.exe 1428 PEDIDO pdf.exe 1428 PEDIDO pdf.exe 1428 PEDIDO pdf.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
PEDIDO pdf.exeipconfig.exepid process 1428 PEDIDO pdf.exe 1428 PEDIDO pdf.exe 1428 PEDIDO pdf.exe 1428 PEDIDO pdf.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe 596 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PEDIDO pdf.exeipconfig.exedescription pid process Token: SeDebugPrivilege 1428 PEDIDO pdf.exe Token: SeDebugPrivilege 596 ipconfig.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
PEDIDO pdf.exeExplorer.EXEipconfig.exedescription pid process target process PID 1348 wrote to memory of 1428 1348 PEDIDO pdf.exe PEDIDO pdf.exe PID 1348 wrote to memory of 1428 1348 PEDIDO pdf.exe PEDIDO pdf.exe PID 1348 wrote to memory of 1428 1348 PEDIDO pdf.exe PEDIDO pdf.exe PID 1348 wrote to memory of 1428 1348 PEDIDO pdf.exe PEDIDO pdf.exe PID 1348 wrote to memory of 1428 1348 PEDIDO pdf.exe PEDIDO pdf.exe PID 1348 wrote to memory of 1428 1348 PEDIDO pdf.exe PEDIDO pdf.exe PID 1348 wrote to memory of 1428 1348 PEDIDO pdf.exe PEDIDO pdf.exe PID 1208 wrote to memory of 596 1208 Explorer.EXE ipconfig.exe PID 1208 wrote to memory of 596 1208 Explorer.EXE ipconfig.exe PID 1208 wrote to memory of 596 1208 Explorer.EXE ipconfig.exe PID 1208 wrote to memory of 596 1208 Explorer.EXE ipconfig.exe PID 596 wrote to memory of 1984 596 ipconfig.exe Firefox.exe PID 596 wrote to memory of 1984 596 ipconfig.exe Firefox.exe PID 596 wrote to memory of 1984 596 ipconfig.exe Firefox.exe PID 596 wrote to memory of 1984 596 ipconfig.exe Firefox.exe PID 596 wrote to memory of 1984 596 ipconfig.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PEDIDO pdf.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PEDIDO pdf.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO pdf.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
819KB
MD5eda40ea55ff2eb2a2e5aca836bb1cc26
SHA16de11b4b121bc8b9b87b05ddbdd6eda4e9442c37
SHA256330b88eacb778b86dff1a90189121e8b3280723be9fbf4e55174ede2bbf74af0
SHA512caf63f50931f76ec919528dedfb8b6ee14590f5aa33f91a6b9c24f63c0f3851cffdc16eab976ee7d6140f383050050d26f3547743b5ae772001b8f6199f0a4fc
-
memory/596-84-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/596-75-0x0000000000000000-mapping.dmp
-
memory/596-79-0x00000000004A0000-0x00000000004AA000-memory.dmpFilesize
40KB
-
memory/596-80-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/596-81-0x00000000021A0000-0x00000000024A3000-memory.dmpFilesize
3.0MB
-
memory/596-82-0x00000000006A0000-0x000000000072F000-memory.dmpFilesize
572KB
-
memory/1208-85-0x0000000004F90000-0x0000000005049000-memory.dmpFilesize
740KB
-
memory/1208-74-0x0000000004D60000-0x0000000004E61000-memory.dmpFilesize
1.0MB
-
memory/1208-83-0x0000000004F90000-0x0000000005049000-memory.dmpFilesize
740KB
-
memory/1208-71-0x0000000004B00000-0x0000000004C07000-memory.dmpFilesize
1.0MB
-
memory/1348-54-0x0000000000E20000-0x0000000000EE2000-memory.dmpFilesize
776KB
-
memory/1348-59-0x0000000000B70000-0x0000000000BA4000-memory.dmpFilesize
208KB
-
memory/1348-58-0x0000000004EF0000-0x0000000004F60000-memory.dmpFilesize
448KB
-
memory/1348-57-0x00000000009C0000-0x00000000009CA000-memory.dmpFilesize
40KB
-
memory/1348-56-0x0000000000480000-0x0000000000490000-memory.dmpFilesize
64KB
-
memory/1348-55-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB
-
memory/1428-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1428-73-0x00000000003E0000-0x00000000003F0000-memory.dmpFilesize
64KB
-
memory/1428-77-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1428-76-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1428-70-0x00000000000F0000-0x0000000000100000-memory.dmpFilesize
64KB
-
memory/1428-69-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/1428-68-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1428-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1428-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1428-64-0x00000000004012B0-mapping.dmp
-
memory/1428-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1428-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB