Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 15:03
Static task
static1
Behavioral task
behavioral1
Sample
Orden de compra del proveedor OC_No 1435 27-03-2023.exe
Resource
win7-20230220-en
General
-
Target
Orden de compra del proveedor OC_No 1435 27-03-2023.exe
-
Size
822KB
-
MD5
91da3743bb05e6744e50fe749f5a9cc6
-
SHA1
fbb00ec09354ded8bf1b7f18f2e9cb2ef0e3d3b3
-
SHA256
b3811fa28d3e22cf5029476f6870c54e7fcd4d68da1342bb199ca6d41ed9ff56
-
SHA512
08bb7e82f83aa4d5146838b8cdc2c40382656c8db8775792d850b3bf5426f53a4e5b9e3420c16e4b4140767a030e0eab9d3339f5182f6390def143d470f3f277
-
SSDEEP
12288:LUJB0Oq8p2ZEtCgO27/mW9XqUjX5OFUuOWGt0p4VedclBeHlOrh1CuQvpAoJhZ:AZpTtV7fjc36veA1Gx9D
Malware Config
Extracted
formbook
4.1
jr22
941zhe.com
lunarportal.space
xn--osmaniyeiek-t9ab.online
trejoscar.com
nrnursery.com
quizcannot.cfd
seedstockersthailand.com
watsonwindow.com
wjfholdings.com
weziclondon.com
naruot.xyz
yeji.plus
classicmenstore.com
oharatravel.com
therapyplankits.com
keviegreshonpt.com
qdlyner.com
seithupaarungal.com
casinorates.online
8ug4as.icu
foamyfallscarwash.com
padelfaculty.com
theenergysavingcentre.com
dorpp.com
scoresendirect.online
yuqintw.com
erenortopedi.com
skymagickey.com
infinitepuremind.com
watchtamilmovie.com
southplainsinsurance.net
intentionaldating.app
certaproarkansas.com
blidai.com
thehoneybeeworks.com
followplace.com
sipsterbyananeke.com
37300.uk
bluebirdbuyers.com
composewithme.com
moneymundo.com
daftarakun.xyz
samsonm.com
nurse-jobs-in-us-35896.com
cancerbloodspecialistsga.net
feelfeminineagain.com
residentialcaretraining.com
allprocleanouts.com
englishsongs.online
bookkeepingdeerfield.com
bendcollegeadvisor.com
boaiqixian.com
vixensgolfcarts.com
igarrido.net
rsconstructiontrading.com
lakewayturf.com
carelesstees.com
silviaheni.xyz
iaqieqq.com
campingspiel.com
diacute.com
thaigeneratortg.com
autoreenter.com
meclishaber.xyz
airbnbtransfers.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/928-150-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/928-211-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2552-223-0x0000000000450000-0x000000000047F000-memory.dmp formbook behavioral2/memory/2552-225-0x0000000000450000-0x000000000047F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Orden de compra del proveedor OC_No 1435 27-03-2023.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation Orden de compra del proveedor OC_No 1435 27-03-2023.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Orden de compra del proveedor OC_No 1435 27-03-2023.exeOrden de compra del proveedor OC_No 1435 27-03-2023.exemsiexec.exedescription pid process target process PID 3924 set thread context of 928 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 928 set thread context of 2372 928 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Explorer.EXE PID 2552 set thread context of 2372 2552 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
powershell.exepowershell.exeOrden de compra del proveedor OC_No 1435 27-03-2023.exeOrden de compra del proveedor OC_No 1435 27-03-2023.exemsiexec.exepid process 112 powershell.exe 2232 powershell.exe 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 928 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 928 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 2232 powershell.exe 928 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 928 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 112 powershell.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe 2552 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2372 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Orden de compra del proveedor OC_No 1435 27-03-2023.exemsiexec.exepid process 928 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 928 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 928 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 2552 msiexec.exe 2552 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
powershell.exepowershell.exeOrden de compra del proveedor OC_No 1435 27-03-2023.exeOrden de compra del proveedor OC_No 1435 27-03-2023.exemsiexec.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2232 powershell.exe Token: SeDebugPrivilege 112 powershell.exe Token: SeDebugPrivilege 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Token: SeDebugPrivilege 928 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Token: SeDebugPrivilege 2552 msiexec.exe Token: SeShutdownPrivilege 2372 Explorer.EXE Token: SeCreatePagefilePrivilege 2372 Explorer.EXE Token: SeShutdownPrivilege 2372 Explorer.EXE Token: SeCreatePagefilePrivilege 2372 Explorer.EXE Token: SeShutdownPrivilege 2372 Explorer.EXE Token: SeCreatePagefilePrivilege 2372 Explorer.EXE Token: SeShutdownPrivilege 2372 Explorer.EXE Token: SeCreatePagefilePrivilege 2372 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Orden de compra del proveedor OC_No 1435 27-03-2023.exeExplorer.EXEmsiexec.exedescription pid process target process PID 3924 wrote to memory of 2232 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe powershell.exe PID 3924 wrote to memory of 2232 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe powershell.exe PID 3924 wrote to memory of 2232 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe powershell.exe PID 3924 wrote to memory of 112 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe powershell.exe PID 3924 wrote to memory of 112 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe powershell.exe PID 3924 wrote to memory of 112 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe powershell.exe PID 3924 wrote to memory of 4004 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe schtasks.exe PID 3924 wrote to memory of 4004 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe schtasks.exe PID 3924 wrote to memory of 4004 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe schtasks.exe PID 3924 wrote to memory of 2712 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 3924 wrote to memory of 2712 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 3924 wrote to memory of 2712 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 3924 wrote to memory of 928 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 3924 wrote to memory of 928 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 3924 wrote to memory of 928 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 3924 wrote to memory of 928 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 3924 wrote to memory of 928 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 3924 wrote to memory of 928 3924 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 2372 wrote to memory of 2552 2372 Explorer.EXE msiexec.exe PID 2372 wrote to memory of 2552 2372 Explorer.EXE msiexec.exe PID 2372 wrote to memory of 2552 2372 Explorer.EXE msiexec.exe PID 2552 wrote to memory of 4612 2552 msiexec.exe cmd.exe PID 2552 wrote to memory of 4612 2552 msiexec.exe cmd.exe PID 2552 wrote to memory of 4612 2552 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YCNgsiXL.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YCNgsiXL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1F6F.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD548bed73c18a8bd03db8c698976b2d3f2
SHA1421f76a325a830ebcfc712b439efc1bf017cbc3b
SHA2567d9205b0c9fa85992d67ad3b3e4e2992baee206aa74e4a1d703235a38fae8016
SHA51201e08da1f9709a866384cd7516c34b6154dd61b67a3a645193e9ed750cd18b6f3ef557622466cc443c857ace491bc5d1efbf1cec50b05267d14cfabeb15e34c0
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_15xh4xny.l5e.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp1F6F.tmpFilesize
1KB
MD5c5dcfa26d18bdeb5b6a6263253165732
SHA1ac9fb7e1ee616100087ce97f41a6ef6727a01cec
SHA25654fb9535820865a8f30dc4cca0610d3855a8f3288e5d15e5cbf704b7587e631c
SHA512a82151c70521d680e5be2e0b955b484a5bcf632a210b1bf794e1582ce13bacb0724bede8e418751bfc3f8634b3492ee7e81a4e817857362ef6dc3c5decf3d562
-
memory/112-189-0x0000000075650000-0x000000007569C000-memory.dmpFilesize
304KB
-
memory/112-204-0x000000007FAD0000-0x000000007FAE0000-memory.dmpFilesize
64KB
-
memory/112-201-0x0000000007370000-0x000000000738A000-memory.dmpFilesize
104KB
-
memory/112-202-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/112-207-0x00000000075F0000-0x0000000007686000-memory.dmpFilesize
600KB
-
memory/112-147-0x00000000050B0000-0x00000000050D2000-memory.dmpFilesize
136KB
-
memory/112-178-0x0000000007010000-0x0000000007042000-memory.dmpFilesize
200KB
-
memory/112-149-0x0000000005A00000-0x0000000005A66000-memory.dmpFilesize
408KB
-
memory/112-172-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/928-175-0x0000000001370000-0x00000000016BA000-memory.dmpFilesize
3.3MB
-
memory/928-150-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/928-211-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/928-176-0x00000000011B0000-0x00000000011C4000-memory.dmpFilesize
80KB
-
memory/2232-203-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/2232-206-0x0000000007A00000-0x0000000007A0A000-memory.dmpFilesize
40KB
-
memory/2232-170-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/2232-171-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/2232-174-0x0000000006690000-0x00000000066AE000-memory.dmpFilesize
120KB
-
memory/2232-148-0x0000000005660000-0x00000000056C6000-memory.dmpFilesize
408KB
-
memory/2232-179-0x0000000075650000-0x000000007569C000-memory.dmpFilesize
304KB
-
memory/2232-190-0x0000000007600000-0x000000000761E000-memory.dmpFilesize
120KB
-
memory/2232-145-0x0000000005780000-0x0000000005DA8000-memory.dmpFilesize
6.2MB
-
memory/2232-200-0x0000000007FE0000-0x000000000865A000-memory.dmpFilesize
6.5MB
-
memory/2232-144-0x00000000050D0000-0x0000000005106000-memory.dmpFilesize
216KB
-
memory/2232-215-0x0000000007CB0000-0x0000000007CB8000-memory.dmpFilesize
32KB
-
memory/2232-210-0x0000000007CD0000-0x0000000007CEA000-memory.dmpFilesize
104KB
-
memory/2232-205-0x000000007F040000-0x000000007F050000-memory.dmpFilesize
64KB
-
memory/2232-208-0x0000000007BC0000-0x0000000007BCE000-memory.dmpFilesize
56KB
-
memory/2372-238-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-241-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-250-0x0000000002540000-0x000000000254A000-memory.dmpFilesize
40KB
-
memory/2372-249-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-248-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-247-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-246-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-245-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-244-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-243-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-242-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-240-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-239-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-177-0x0000000007A60000-0x0000000007BAC000-memory.dmpFilesize
1.3MB
-
memory/2372-237-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-228-0x0000000008550000-0x0000000008631000-memory.dmpFilesize
900KB
-
memory/2372-229-0x0000000008550000-0x0000000008631000-memory.dmpFilesize
900KB
-
memory/2372-231-0x0000000008550000-0x0000000008631000-memory.dmpFilesize
900KB
-
memory/2372-234-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-235-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2372-236-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/2552-213-0x0000000000FB0000-0x0000000000FC2000-memory.dmpFilesize
72KB
-
memory/2552-227-0x0000000000E70000-0x0000000000F03000-memory.dmpFilesize
588KB
-
memory/2552-224-0x00000000023E0000-0x000000000272A000-memory.dmpFilesize
3.3MB
-
memory/2552-222-0x0000000000FB0000-0x0000000000FC2000-memory.dmpFilesize
72KB
-
memory/2552-209-0x0000000000FB0000-0x0000000000FC2000-memory.dmpFilesize
72KB
-
memory/2552-223-0x0000000000450000-0x000000000047F000-memory.dmpFilesize
188KB
-
memory/2552-225-0x0000000000450000-0x000000000047F000-memory.dmpFilesize
188KB
-
memory/3924-134-0x0000000005210000-0x00000000057B4000-memory.dmpFilesize
5.6MB
-
memory/3924-138-0x0000000002740000-0x0000000002750000-memory.dmpFilesize
64KB
-
memory/3924-135-0x0000000004C60000-0x0000000004CF2000-memory.dmpFilesize
584KB
-
memory/3924-139-0x0000000007BD0000-0x0000000007C6C000-memory.dmpFilesize
624KB
-
memory/3924-137-0x0000000004C10000-0x0000000004C1A000-memory.dmpFilesize
40KB
-
memory/3924-136-0x0000000002740000-0x0000000002750000-memory.dmpFilesize
64KB
-
memory/3924-133-0x0000000000170000-0x0000000000244000-memory.dmpFilesize
848KB