950a5c5455b3d7a4ee27ff5bc7cea2ade2d507770a3cc15106018bfedae9ca52

General

Target

ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe
Size

2.4MB
MD5

fea126096e142649211027c6edbb9832
SHA1

e5e259235d3d77065918b3c4c369f9d74f1868d7
SHA256

950a5c5455b3d7a4ee27ff5bc7cea2ade2d507770a3cc15106018bfedae9ca52
SHA512

1f50c406c59fa74b95d97596a04b2cc132ede28bbe00c306aaa1bd3056942713f99aa5e5cf93022d652abb2fcacf7d6e24feec4e572a9aaff64368d1b0d28293
SSDEEP

12288:SSR2wX/utnvc69mP51M1nkPpVys8b5V29HxJu5YF9Iv3dosUg7JZtY:SSHuRc69mP/M5kmL/aHxJZIv3W42

Score

10^/10

evasion execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2297530677-1229052932-2803917579-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	sc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RRETML50UJDP = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2552	powershell.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2420 set thread context of 2496	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	33
PID 2496 set thread context of 2420	2496	iexplore.exe	27
PID 2496 set thread context of 2420	2496	iexplore.exe	27
PID 2496 set thread context of 2420	2496	iexplore.exe	27
PID 2496 set thread context of 1212	2496	iexplore.exe	21
PID 2496 set thread context of 1952	2496	iexplore.exe	37
PID 1952 set thread context of 2420	1952	sc.exe	27

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1952	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2552	powershell.exe
2496	iexplore.exe
2496	iexplore.exe
2496	iexplore.exe
2496	iexplore.exe
2496	iexplore.exe
2496	iexplore.exe
2496	iexplore.exe
2496	iexplore.exe
2496	iexplore.exe
2496	iexplore.exe
2496	iexplore.exe
1952	sc.exe
1952	sc.exe
1952	sc.exe
1952	sc.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2496	iexplore.exe
2496	iexplore.exe
2496	iexplore.exe
2496	iexplore.exe
1212	Explorer.EXE
1212	Explorer.EXE
1952	sc.exe
1952	sc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2552	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	29
PID 2420 wrote to memory of 2552	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	29
PID 2420 wrote to memory of 2552	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	29
PID 2420 wrote to memory of 2684	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	31
PID 2420 wrote to memory of 2684	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	31
PID 2420 wrote to memory of 2684	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	31
PID 2420 wrote to memory of 2684	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	31
PID 2420 wrote to memory of 2684	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	31
PID 2420 wrote to memory of 2584	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	32
PID 2420 wrote to memory of 2584	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	32
PID 2420 wrote to memory of 2584	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	32
PID 2420 wrote to memory of 2584	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	32
PID 2420 wrote to memory of 2496	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	33
PID 2420 wrote to memory of 2496	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	33
PID 2420 wrote to memory of 2496	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	33
PID 2420 wrote to memory of 2496	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	33
PID 2420 wrote to memory of 2496	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	33
PID 2420 wrote to memory of 2496	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	33
PID 2420 wrote to memory of 2496	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	33
PID 2420 wrote to memory of 2740	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	34
PID 2420 wrote to memory of 2740	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	34
PID 2420 wrote to memory of 2740	2420	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe	34
PID 1212 wrote to memory of 1952	1212	Explorer.EXE	37
PID 1212 wrote to memory of 1952	1212	Explorer.EXE	37
PID 1212 wrote to memory of 1952	1212	Explorer.EXE	37
PID 1212 wrote to memory of 1952	1212	Explorer.EXE	37

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe
  "C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:2684
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
    3⤵
    PID:2584
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2496
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2420 -s 944
    3⤵
    PID:2740
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\SysWOW64\sc.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Launches sc.exe
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-22-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/1952-21-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/2420-0-0x000007FEF5863000-0x000007FEF5864000-memory.dmp

Filesize
4KB

Download
memory/2420-1-0x0000000000D10000-0x0000000000D5C000-memory.dmp

Filesize
304KB

Download
memory/2420-2-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download
memory/2420-3-0x000000001B930000-0x000000001B97C000-memory.dmp

Filesize
304KB

Download
memory/2420-4-0x0000000000600000-0x000000000069A000-memory.dmp

Filesize
616KB

Download
memory/2420-18-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download
memory/2420-17-0x000007FEF5863000-0x000007FEF5864000-memory.dmp

Filesize
4KB

Download
memory/2496-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2552-14-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2552-13-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2684-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2684-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads