9f04e9df13edb801c21c1855667396bc18abc4bddc2215174f6e91e91e01f212

General

Target

Re Confirmación de pedido-5309, pdf.exe
Size

886KB
MD5

16f68b2c1d048e55cf61ccbbf479effe
SHA1

8c12e5b023cc6806d5890163baffee81cce9afaa
SHA256

348f9d5b52f4b01c9886af630c02a8cfe9dec0ddf882fe906e0b04f921ab1fff
SHA512

c732e466a0ee1d703c4dfe7c3c098c1d674c87fac4a60db4f47d7bbe4742c9fc9ac8c3826f9d1e5844e076e9e28e4ecdbfc2d12e48e23352dc5a568f6a347bd0

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Re Confirmación de pedido-5309, pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Gmeguaz = "C:\\Users\\Public\\Libraries\\zaugemG.url"	Re Confirmación de pedido-5309, pdf.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

432 1516 WerFault.exe dialer.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

432 WerFault.exe
432 WerFault.exe
432 WerFault.exe
432 WerFault.exe
432 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

432 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 432 WerFault.exe

pid	pid_target	process	target process
432	1516	WerFault.exe	dialer.exe

pid	process
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe

pid	process
432	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	432	WerFault.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Re Confirmación de pedido-5309, pdf.exedialer.exe

description	pid	process	target process
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 2016 wrote to memory of 1516	2016	Re Confirmación de pedido-5309, pdf.exe	dialer.exe
PID 1516 wrote to memory of 432	1516	dialer.exe	WerFault.exe
PID 1516 wrote to memory of 432	1516	dialer.exe	WerFault.exe
PID 1516 wrote to memory of 432	1516	dialer.exe	WerFault.exe
PID 1516 wrote to memory of 432	1516	dialer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Re Confirmación de pedido-5309, pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Re Confirmación de pedido-5309, pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\dialer.exe
C:\Windows\System32\dialer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 148
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-67-0x0000000000000000-mapping.dmp

Download
memory/432-73-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1516-65-0x0000000000000000-mapping.dmp

Download
memory/1516-70-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1516-68-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1516-71-0x0000000010590000-0x000000001060D000-memory.dmp

Filesize
500KB

Download
memory/1516-69-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2016-60-0x00000000002F0000-0x000000000030B000-memory.dmp

Filesize
108KB

Download
memory/2016-63-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2016-64-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing