6c2ca93949c6c8463079056deb121abcaea9934dcd860024624a4b0d53093204

General

Target

confirmación de solicitud de documento DOC.ex.exe
Size

628KB
MD5

f92cfccc787573ad96e73fe5df999ebc
SHA1

8213016a7c85c3ca70f30b9afdc60d3d6e4c82cc
SHA256

6c2ca93949c6c8463079056deb121abcaea9934dcd860024624a4b0d53093204
SHA512

631163c9150eb79d001859d46df7b8df184c98c2ead25332a179642a681f5bea890094d935fb4299d2691b2fc82188e180bd96a89767cf68c3dd08b95257385f

Score

8^/10

persistence upx

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

34 3548 mshta.exe

flow	pid	process
34	3548	mshta.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3548-126-0x0000000010410000-0x00000000107F4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

confirmación de solicitud de documento DOC.ex.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bpwzer = "C:\\Users\\Public\\Libraries\\rezwpB.url"	confirmación de solicitud de documento DOC.ex.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

mshta.exe

pid process

3548 mshta.exe
3548 mshta.exe
3548 mshta.exe
3548 mshta.exe
3548 mshta.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

mshta.exe

description pid process

Token: SeShutdownPrivilege 3548 mshta.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

mshta.exe

pid process

3548 mshta.exe
3548 mshta.exe

pid	process
3548	mshta.exe
3548	mshta.exe
3548	mshta.exe
3548	mshta.exe
3548	mshta.exe

description	pid	process
Token: SeShutdownPrivilege	3548	mshta.exe

pid	process
3548	mshta.exe
3548	mshta.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

confirmación de solicitud de documento DOC.ex.exe

description	pid	process	target process
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe
PID 3724 wrote to memory of 3548	3724	confirmación de solicitud de documento DOC.ex.exe	mshta.exe

C:\Users\Admin\AppData\Local\Temp\confirmación de solicitud de documento DOC.ex.exe
"C:\Users\Admin\AppData\Local\Temp\confirmación de solicitud de documento DOC.ex.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3724

C:\Windows\SysWOW64\mshta.exe
C:\Windows\System32\mshta.exe
2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3548-119-0x0000000000000000-mapping.dmp

Download
memory/3548-120-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/3548-125-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/3548-124-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/3548-126-0x0000000010410000-0x00000000107F4000-memory.dmp

Filesize
3.9MB

Download
memory/3724-114-0x00000000004A0000-0x000000000054E000-memory.dmp

Filesize
696KB

Download
memory/3724-116-0x0000000002200000-0x000000000221A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads