94786b06c92a58b375e26bc1328492f06baed13f77e8140f8a2cc892883b4c1e

General

Target

JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe
Size

762KB
MD5

91ab88ebf2f83aa5c1b1979c37b9ffd3
SHA1

463501f21d5062bfd8f5acb5efd3c8e387e0bb0d
SHA256

94786b06c92a58b375e26bc1328492f06baed13f77e8140f8a2cc892883b4c1e
SHA512

7823d581290e5e53b11320ada2fa88346a1ed58dbd19476f3ee7a6b1e4ec26e21fe841975d93133afc87f820e95844baad34449d0aa6ac20077f2d9123af3fc4
SSDEEP

12288:EPpIEmdhqR0GV9XOOxg+Jf1PcezkBWIbyuwQL3OWntl81tTTZ/Oi5DwFyEionDu1:IpaCWGHXOOxgveC5yRQLvf81BV2m6iow

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2728	powershell.exe
2668	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\folkepensionsaldres\frostbiter.ini	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Stilting.Bra	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe
File opened for modification	C:\Program Files (x86)\unprobably.ini	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Levitters.lnk	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe
File opened for modification	C:\Windows\Levitters.lnk	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe
File opened for modification	C:\Windows\resources\beent.elv	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2728	powershell.exe
2668	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2704	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2728	2704	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	30
PID 2704 wrote to memory of 2728	2704	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	30
PID 2704 wrote to memory of 2728	2704	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	30
PID 2704 wrote to memory of 2728	2704	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	30
PID 2704 wrote to memory of 2668	2704	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	32
PID 2704 wrote to memory of 2668	2704	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	32
PID 2704 wrote to memory of 2668	2704	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	32
PID 2704 wrote to memory of 2668	2704	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	32

C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe
"C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "$Zinged=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\Stragglier\Scyphus\Chefassistent.Tro';$bagwyn=$Zinged.SubString(52013,3);.$bagwyn($Zinged)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "$Zinged=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\Stragglier\Scyphus\Chefassistent.Tro';$bagwyn=$Zinged.SubString(52013,3);.$bagwyn($Zinged)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
37bc8ada40dd484841c50ef4a318b138

SHA1
a703a026a6443440b18736462342570fb99da6f1

SHA256
8de27877808a767ec2f210b94b2d25b58e6bf8aad3d4f3a37b249368189aa92d

SHA512
615b2557e9025a917ae419df2f467544ddcfb0b49b0a263fba148d47f6b0d98747f61b07628732b113776d804572101e8c3ed970d6b2e94c620306a1252d159b

Download Submit
memory/2728-16-0x0000000073C41000-0x0000000073C42000-memory.dmp

Filesize
4KB

Download
memory/2728-17-0x0000000073C40000-0x00000000741EB000-memory.dmp

Filesize
5.7MB

Download
memory/2728-19-0x0000000073C40000-0x00000000741EB000-memory.dmp

Filesize
5.7MB

Download
memory/2728-20-0x0000000073C40000-0x00000000741EB000-memory.dmp

Filesize
5.7MB

Download
memory/2728-18-0x0000000073C40000-0x00000000741EB000-memory.dmp

Filesize
5.7MB

Download
memory/2728-21-0x0000000073C40000-0x00000000741EB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing