Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2022 14:55
Static task
static1
Behavioral task
behavioral1
Sample
PEDIDO pdf.exe
Resource
win7-20220901-en
General
-
Target
PEDIDO pdf.exe
-
Size
752KB
-
MD5
e3698fc9d5c6152297de00168360d550
-
SHA1
eb53bcf6fd90162cc5b3d74fd018e6a981919c43
-
SHA256
26166c41b0a5364406a3c3f9c42d3f2bc3786aa5f32c71ee0675773bd7cc2125
-
SHA512
7c3c6c80fbda902fbde5ff554147852295d7c9508f4237ca3fba8ce03e7ae94cabb8d259f01dcd029036c5b7e845ac6c657a7638b5e9319ff66f6f298d9e55f2
-
SSDEEP
12288:mUdLctyTcf0hA/p4f2MjHJJY90LmRO1oTznmbhMGg3g43XR8:0UT40a/p4f2QLmEiTznmbvg3R3XR8
Malware Config
Extracted
formbook
asdo
31/RFVD/FFkpCuo=
LS2evkT1Hf54yJ3A01ZhjLFKSw==
Dw25w8eoM4HRQ9T8YA==
F2rI9TgH1uCf
VOuuxD/qTPifG/QDJ76coQ==
9smUEHwvvAcD3rnTM3IZg7fh
k4RlZq6jXYrfEg==
1+E7QsiGloB8qoio4Oh/
dALS/H0nMg+jCtM1RpZ+
thNv9GMouDLIFvESJ76coQ==
Tc54uifIU66mck2hvrtXnVbp
cINUAYgiqlkpCuo=
ma2AwPyPmpxd2bPRMksak0T7uEg9kA==
RlMlYJ9UpFIz7dg1RpZ+
klG+mNmHrHcFhmZ12SNGhmN+0f6MaMs=
V/nT2VgHD+hito+tBumEzTyVl5g=
0Zto8FjseN7v8MAW6ZkZg7fh
gbGlkddlXYrfEg==
pymXGHouvjhnKg8+qD8bLcY=
VelU01Tk/+CzegtywL4=
beu8i8uQo444B/I=
l1M5dadWfFDeV+s9sqk=
/dYkHYIfGV7iGA==
yI9kAZU8sDb2xrLNME4qL1L8A1UDR0OUTA==
Kfe3Bk7moSq5R+T9SYR9qQ==
qOu+wD/TXqzjQ9T8YA==
gwj+jqGpw1nLC/0=
AossQ3UoIIdVQaw8Qrt39kyJVA==
8LSKJa5YfmQ89cT/ecbD8xsqqOY2WJHY
0B3g3lkKOCTyMP4Y
wsAuMK9S5GDVQ9T8YA==
MWg6ADHDUNx798o1RpZ+
+72b1gyswJlV+Nc1RpZ+
Sw3lduGKXYrfEg==
80+uIIs4wk0fHfc=
pD8e4SDKUbj08LYZJnmGrg==
xxTq1hvSAQGl6Nf8PpOhCN12a4U=
YqmMV6xd71Cj38P0TZSIzjyVl5g=
dvNQ4FX8oersPiFXxNd2
LQfLIFcA+NFGmnSu/Wd6s03ye5CxR0OUTA==
qwNh7W8Yp1kpCuo=
BVci+UD6CS+lIfca
EAPiDT3fBA7wuI28CTu0J9E=
cLWLnh7W7vPyMP4Y
AIvnULNVyjd7rUx3wbw=
4eNBGEvs69ru8Lz+J76coQ==
xij4yO2DJIbQQ9T8YA==
DtnMDfkH1uCf
Vdm1hqpJVmckmGyb+xHn6yvMWKdbtz/X
6suQ4TbR5PHHaTNdwBoyUXqbrulBPsU=
iUJfoPR8XYrfEg==
1dg8GFYOGfbyMP4Y
jJZbru2GpG/VQ9T8YA==
BYtrRoA53ixudFOW/ju0J9E=
t0YlD4JO+WejmX6b7Du0J9E=
SBd2efu0XOnu/+g=
lSmLCnwmxiAe/MvoOVYzPjyVl5g=
BhFhVLlkzKEOQ9T8YA==
HeW78yHca87Xtpy7GGFep077uEg9kA==
aTobtETW3LLDMhpFkItevrdLQw==
laVzGpVKyTx+bQtywL4=
QDubmhTJgQ0OHvc=
K6PvmaTA4K0TQ9T8YA==
5/FSIl39tjnJF/ISJ76coQ==
somosterraingenieria.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PEDIDO pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation PEDIDO pdf.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PEDIDO pdf.exePEDIDO pdf.execolorcpl.exedescription pid process target process PID 4160 set thread context of 4448 4160 PEDIDO pdf.exe PEDIDO pdf.exe PID 4448 set thread context of 1048 4448 PEDIDO pdf.exe Explorer.EXE PID 3904 set thread context of 1048 3904 colorcpl.exe Explorer.EXE -
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
PEDIDO pdf.execolorcpl.exepid process 4448 PEDIDO pdf.exe 4448 PEDIDO pdf.exe 4448 PEDIDO pdf.exe 4448 PEDIDO pdf.exe 4448 PEDIDO pdf.exe 4448 PEDIDO pdf.exe 4448 PEDIDO pdf.exe 4448 PEDIDO pdf.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1048 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
PEDIDO pdf.execolorcpl.exepid process 4448 PEDIDO pdf.exe 4448 PEDIDO pdf.exe 4448 PEDIDO pdf.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe 3904 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
PEDIDO pdf.execolorcpl.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4448 PEDIDO pdf.exe Token: SeDebugPrivilege 3904 colorcpl.exe Token: SeShutdownPrivilege 1048 Explorer.EXE Token: SeCreatePagefilePrivilege 1048 Explorer.EXE Token: SeShutdownPrivilege 1048 Explorer.EXE Token: SeCreatePagefilePrivilege 1048 Explorer.EXE Token: SeShutdownPrivilege 1048 Explorer.EXE Token: SeCreatePagefilePrivilege 1048 Explorer.EXE Token: SeShutdownPrivilege 1048 Explorer.EXE Token: SeCreatePagefilePrivilege 1048 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PEDIDO pdf.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 4160 wrote to memory of 4448 4160 PEDIDO pdf.exe PEDIDO pdf.exe PID 4160 wrote to memory of 4448 4160 PEDIDO pdf.exe PEDIDO pdf.exe PID 4160 wrote to memory of 4448 4160 PEDIDO pdf.exe PEDIDO pdf.exe PID 4160 wrote to memory of 4448 4160 PEDIDO pdf.exe PEDIDO pdf.exe PID 4160 wrote to memory of 4448 4160 PEDIDO pdf.exe PEDIDO pdf.exe PID 4160 wrote to memory of 4448 4160 PEDIDO pdf.exe PEDIDO pdf.exe PID 1048 wrote to memory of 3904 1048 Explorer.EXE colorcpl.exe PID 1048 wrote to memory of 3904 1048 Explorer.EXE colorcpl.exe PID 1048 wrote to memory of 3904 1048 Explorer.EXE colorcpl.exe PID 3904 wrote to memory of 2880 3904 colorcpl.exe Firefox.exe PID 3904 wrote to memory of 2880 3904 colorcpl.exe Firefox.exe PID 3904 wrote to memory of 2880 3904 colorcpl.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PEDIDO pdf.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PEDIDO pdf.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO pdf.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1048-153-0x0000000008220000-0x0000000008337000-memory.dmpFilesize
1.1MB
-
memory/1048-169-0x0000000002B90000-0x0000000002BA0000-memory.dmpFilesize
64KB
-
memory/1048-168-0x0000000002B90000-0x0000000002BA0000-memory.dmpFilesize
64KB
-
memory/1048-167-0x0000000002B90000-0x0000000002BA0000-memory.dmpFilesize
64KB
-
memory/1048-166-0x0000000002B80000-0x0000000002B90000-memory.dmpFilesize
64KB
-
memory/1048-165-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1048-164-0x0000000002B90000-0x0000000002BA0000-memory.dmpFilesize
64KB
-
memory/1048-163-0x0000000002B90000-0x0000000002BA0000-memory.dmpFilesize
64KB
-
memory/1048-162-0x0000000002B90000-0x0000000002BA0000-memory.dmpFilesize
64KB
-
memory/1048-161-0x0000000002B80000-0x0000000002B90000-memory.dmpFilesize
64KB
-
memory/1048-159-0x0000000002B90000-0x0000000002BA0000-memory.dmpFilesize
64KB
-
memory/1048-145-0x00000000083D0000-0x000000000854C000-memory.dmpFilesize
1.5MB
-
memory/1048-160-0x0000000002B90000-0x0000000002BA0000-memory.dmpFilesize
64KB
-
memory/1048-158-0x0000000002B90000-0x0000000002BA0000-memory.dmpFilesize
64KB
-
memory/1048-157-0x0000000002B80000-0x0000000002B90000-memory.dmpFilesize
64KB
-
memory/1048-156-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1048-155-0x0000000008220000-0x0000000008337000-memory.dmpFilesize
1.1MB
-
memory/3904-152-0x00000000029D0000-0x0000000002A5F000-memory.dmpFilesize
572KB
-
memory/3904-151-0x0000000002BA0000-0x0000000002EEA000-memory.dmpFilesize
3.3MB
-
memory/3904-154-0x0000000000960000-0x000000000098D000-memory.dmpFilesize
180KB
-
memory/3904-149-0x0000000000290000-0x00000000002A9000-memory.dmpFilesize
100KB
-
memory/3904-150-0x0000000000960000-0x000000000098D000-memory.dmpFilesize
180KB
-
memory/3904-146-0x0000000000000000-mapping.dmp
-
memory/4160-136-0x0000000007B50000-0x0000000007BEC000-memory.dmpFilesize
624KB
-
memory/4160-133-0x00000000058E0000-0x0000000005E84000-memory.dmpFilesize
5.6MB
-
memory/4160-134-0x0000000005210000-0x00000000052A2000-memory.dmpFilesize
584KB
-
memory/4160-132-0x0000000000900000-0x00000000009C2000-memory.dmpFilesize
776KB
-
memory/4160-135-0x0000000005300000-0x000000000530A000-memory.dmpFilesize
40KB
-
memory/4448-144-0x0000000000E60000-0x0000000000E70000-memory.dmpFilesize
64KB
-
memory/4448-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4448-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4448-137-0x0000000000000000-mapping.dmp
-
memory/4448-141-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4448-142-0x00000000013A0000-0x00000000016EA000-memory.dmpFilesize
3.3MB
-
memory/4448-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4448-148-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB