Analysis Report VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe

ID:	395503
Product:	CloudBasic
Start time:	15:54:49
Start date:	22.04.2021
Sample:	VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	b1b0e80b7df8ae67ed83e366f46b265b
SHA1:	53c2f6377d7cc97ccb2c718eeabbf16e00830656
SHA256:	ec455e6dcab1f953bd685bc9674dbe7e2fbf7afcbef4d731edd9a818048f2227
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Found malware configuration

Source: 00000000.00000002.810709106.0000000000580000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1eFQiCYQnU0gxJtdFGliDTfHvfIG3lmKt", "Injection Process": ["RegAsm.exe", "RegSvcs.exe", "MSBuild.exe"]}

Multi AV Scanner detection for submitted file

Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Virustotal: Detection: 20%			Perma Link
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	ReversingLabs: Detection: 19%

Machine Learning detection for sample

Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1eFQiCYQnU0gxJtdFGliDTfHvfIG3lmKt

System Summary:

PE file contains strange resources

Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.815929680.0000000002B50000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewdmaud.drv.muij% vs VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.810433195.0000000000423000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameVitiations3.exe vs VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.815804111.0000000002A20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameVitiations3.exeFE2X vs VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.815804111.0000000002A20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameVitiations3.exeFE2XSoftSignalC vs VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.815804111.0000000002A20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameVitiations3.exeFE2XSoftSignal vs VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.815804111.0000000002A20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameVitiations3.exeFE2XSoftSignalN vs VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.815804111.0000000002A20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameVitiations3.exeFE2XSoftSignal' vs VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.815804111.0000000002A20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameVitiations3.exeFE2XSoftSignalI vs VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.815804111.0000000002A20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameVitiations3.exeFE2XSoftSignal" vs VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.815804111.0000000002A20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameVitiations3.exeFE2XSoftSignalT vs VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.812873484.00000000021F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Binary or memory string: OriginalFilenameVitiations3.exe vs VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe

Uses 32bit PE files

Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Classification label

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/0@0/0

Creates temporary files

Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DF84F0FE996D23CFC0.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Virustotal: Detection: 20%
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	ReversingLabs: Detection: 19%

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.810709106.0000000000580000.00000040.00000001.sdmp, type: MEMORY

PE file contains an invalid checksum

Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe

Static PE information: real checksum: 0x30b8d should be: 0x33065

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_0040445E push edi; iretd		0_2_0040445F
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_0040527C push edx; ret		0_2_0040528B
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_004052E0 push esi; retf		0_2_004052EA
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_004032EE push edx; ret		0_2_004032EF
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_00405296 push edx; ret		0_2_0040528B
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_00401CA1 push ss; retf 0000h		0_2_00401CA2
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_00406757 push esi; iretd		0_2_004067F3
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_00403575 push 00000034h; retf		0_2_0040357E
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_004067D4 push esi; iretd		0_2_004067F3
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_004039D6 push edx; ret		0_2_004039FF
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_004035D8 push eax; ret		0_2_004035DB
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_00403F85 push ebp; ret		0_2_00403F86
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Code function: 0_2_004067A1 push esi; iretd		0_2_004067D3

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	RDTSC instruction interceptor: First address: 000000000040A029 second address: 000000000040A029 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, 000000E4h 0x00000008 cmp eax, 000000A2h 0x0000000d cmp eax, 3Ch 0x00000010 cmp eax, 79h 0x00000013 cmp ebx, 0Bh 0x00000016 wait 0x00000017 fnclex 0x00000019 punpckldq xmm2, xmm3 0x0000001d paddsb mm0, mm4 0x00000020 punpcklwd mm0, mm4 0x00000023 punpckldq mm0, mm1 0x00000026 packuswb xmm5, xmm2 0x0000002a jmp 00007F45D4A1BDBBh 0x0000002c cmp eax, 3Fh 0x0000002f cmp ebx, 6Eh 0x00000032 cmp ebx, 00000096h 0x00000038 cmp edi, 002EAFF4h 0x0000003e movd mm1, ebx 0x00000041 movd mm1, ebx 0x00000044 movd mm1, ebx 0x00000047 movd mm1, ebx 0x0000004a jne 00007F45D4A1BC1Fh 0x00000050 inc edi 0x00000051 cmp eax, 47h 0x00000054 cmp ebx, 000000CDh 0x0000005a cmp ebx, 000000A7h 0x00000060 cmp eax, 000000DDh 0x00000065 cmp ebx, 36h 0x00000068 cmp eax, 3Ch 0x0000006b cmp eax, 68h 0x0000006e fdiv st(0), st(0) 0x00000070 psubusb xmm6, xmm6 0x00000074 paddw xmm1, xmm4 0x00000078 fldl2t 0x0000007a por xmm6, xmm1 0x0000007e psubw mm2, mm6 0x00000081 por mm1, mm2 0x00000084 jmp 00007F45D4A1BDBBh 0x00000086 cmp ebx, 000000C1h 0x0000008c cmp ebx, 000000AEh 0x00000092 cmp eax, 5Bh 0x00000095 rdtsc
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	RDTSC instruction interceptor: First address: 00000000005863AE second address: 00000000005833A8 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 test bh, ch 0x00000005 ret 0x00000006 cmp dh, bh 0x00000008 test dl, FFFFFFC4h 0x0000000b call 00007F45D4CE1CB1h 0x00000010 cmp eax, ecx 0x00000012 call 00007F45D4CDECB7h 0x00000017 test ah, bh 0x00000019 cmp cl, cl 0x0000001b cmp ch, bh 0x0000001d xor edi, edi 0x0000001f test ax, dx 0x00000022 mov ecx, 00A95F60h 0x00000027 test di, 3043h 0x0000002c push ecx 0x0000002d jmp 00007F45D4CDEDEAh 0x0000002f cmp dx, bx 0x00000032 call 00007F45D4CDEE1Bh 0x00000037 call 00007F45D4CDEE04h 0x0000003c lfence 0x0000003f mov edx, dword ptr [7FFE0014h] 0x00000045 lfence 0x00000048 ret 0x00000049 mov esi, edx 0x0000004b pushad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe	RDTSC instruction interceptor: First address: 00000000005833A8 second address: 00000000005833A8 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F45D4A1BD84h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp dl, bl 0x0000001f pop ecx 0x00000020 test ax, dx 0x00000023 test edx, ebx 0x00000025 add edi, edx 0x00000027 cmp ch, FFFFFFA4h 0x0000002a dec ecx 0x0000002b nop 0x0000002c cmp ecx, 00000000h 0x0000002f jne 00007F45D4A1BD2Bh 0x00000031 push ecx 0x00000032 jmp 00007F45D4A1BD7Ah 0x00000034 cmp dx, bx 0x00000037 call 00007F45D4A1BDABh 0x0000003c call 00007F45D4A1BD94h 0x00000041 lfence 0x00000044 mov edx, dword ptr [7FFE0014h] 0x0000004a lfence 0x0000004d ret 0x0000004e mov esi, edx 0x00000050 pushad 0x00000051 rdtsc

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.812567759.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.812567759.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.812567759.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: VENTANASBRISA SL, COMPROBANTE DE TRANSFERENCIA PENDIENTE DE PAGO.exe, 00000000.00000002.812567759.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock