f52802b0c8c6e76942c7c05d54d0f5cb6a25b69035c0ee9cbbb9e1028f76cd27 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 16:22

Sharing

Report Analysis Logs

General

Target

comprobantes de pago.exe
Size

77.0MB
MD5

8bcb70565d9d32c3466fb9b56bfcf96b
SHA1

e85c2b8ae6feb421143e44d441d6abc79426c2bc
SHA256

04017385f3c4b8858022a5952b59089a66a59830a4c5443bdb83e6168631b3b4
SHA512

ee9bbb8c50870cda04030aed6aa18b0a2338ac3f67bce66d7d10e74c0874075700397befda1806b626545edf917e9cc787c6740267502d3a373dc649e4d6aaef
SSDEEP

24576:jtb20pkaCqT5TBWgNQ7aG6It476J5WCL/6TY6A:gVg5tQ7aGJpn/J5

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3988	4192	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

Processes:

comprobantes de pago.execomprobantes de pago.execomprobantes de pago.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	comprobantes de pago.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	comprobantes de pago.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	comprobantes de pago.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

comprobantes de pago.execomprobantes de pago.execomprobantes de pago.exe

pid	Process
3544	comprobantes de pago.exe
2652	comprobantes de pago.exe
4192	comprobantes de pago.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

comprobantes de pago.execomprobantes de pago.execomprobantes de pago.exe

pid	Process
3544	comprobantes de pago.exe
3544	comprobantes de pago.exe
3544	comprobantes de pago.exe
2652	comprobantes de pago.exe
2652	comprobantes de pago.exe
4192	comprobantes de pago.exe
4192	comprobantes de pago.exe

Suspicious use of SendNotifyMessage 7 IoCs

Processes:

comprobantes de pago.execomprobantes de pago.execomprobantes de pago.exe

pid	Process
3544	comprobantes de pago.exe
3544	comprobantes de pago.exe
3544	comprobantes de pago.exe
2652	comprobantes de pago.exe
2652	comprobantes de pago.exe
4192	comprobantes de pago.exe
4192	comprobantes de pago.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

comprobantes de pago.execomprobantes de pago.execomprobantes de pago.exe

description	pid	Process	procid_target
PID 3544 wrote to memory of 2868	3544	comprobantes de pago.exe	85
PID 3544 wrote to memory of 2868	3544	comprobantes de pago.exe	85
PID 3544 wrote to memory of 2868	3544	comprobantes de pago.exe	85
PID 3544 wrote to memory of 2652	3544	comprobantes de pago.exe	86
PID 3544 wrote to memory of 2652	3544	comprobantes de pago.exe	86
PID 3544 wrote to memory of 2652	3544	comprobantes de pago.exe	86
PID 2652 wrote to memory of 2992	2652	comprobantes de pago.exe	89
PID 2652 wrote to memory of 2992	2652	comprobantes de pago.exe	89
PID 2652 wrote to memory of 2992	2652	comprobantes de pago.exe	89
PID 2652 wrote to memory of 4192	2652	comprobantes de pago.exe	90
PID 2652 wrote to memory of 4192	2652	comprobantes de pago.exe	90
PID 2652 wrote to memory of 4192	2652	comprobantes de pago.exe	90
PID 4192 wrote to memory of 4520	4192	comprobantes de pago.exe	93
PID 4192 wrote to memory of 4520	4192	comprobantes de pago.exe	93
PID 4192 wrote to memory of 4520	4192	comprobantes de pago.exe	93

C:\Users\Admin\AppData\Local\Temp\comprobantes de pago.exe
"C:\Users\Admin\AppData\Local\Temp\comprobantes de pago.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\comprobantes de pago.exe"
  2⤵
  PID:2868
- C:\Users\Admin\AppData\Local\Temp\comprobantes de pago.exe
  "C:\Users\Admin\AppData\Local\Temp\comprobantes de pago.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\comprobantes de pago.exe"
    3⤵
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\comprobantes de pago.exe
    "C:\Users\Admin\AppData\Local\Temp\comprobantes de pago.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\comprobantes de pago.exe"
      4⤵
      PID:4520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 196
      4⤵
      Program crash
      PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4192 -ip 4192
1⤵
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autDDDD.tmp

Filesize
195KB

MD5
ecbc66e568174fe2bde81b9e43156e25

SHA1
cc0c0d6bf98e555e75825dada90727f1614bdb77

SHA256
b6ce8c715241fb762845815cf263cf87a07be1872eb7e5a173eeecf6995bb325

SHA512
8cf08fcd2125ed97d567009bf6e891e18f51f5dcce87e726166fddce8266ddc2a4852a82feb7c52205c92759b9f5092bb6f46e5b06fb19ca76a94b391a3ab165

Download Submit
C:\Users\Admin\AppData\Local\Temp\snaith

Filesize
203KB

MD5
a1019e9ab20b0bec25461bfc8d719252

SHA1
9581db8a745f520dd8d08790dd3c663f1530e042

SHA256
0c1a5951b8da5e58d2cb1fb11d51f0f7b7a2af961930120f5707633d33733948

SHA512
282b455d37b1aa7c0248f89a4842c5aff2fccef427b9b4728d17eb8aafdf6f1f3d1452655c05fed2e35deb5a6c0efdbe06b3232da69b3cd8fde5016319495532

Download Submit
memory/2652-14-0x0000000000CB0000-0x00000000010B0000-memory.dmp

Filesize
4.0MB

Download
memory/3544-6-0x00000000016B0000-0x0000000001AB0000-memory.dmp

Filesize
4.0MB

Download
memory/4192-22-0x0000000001430000-0x0000000001830000-memory.dmp

Filesize
4.0MB

Download