8dd453814cc59ecb7918da706244b3e8aacc66146b9ff80bcad195e066464139

General

Target
orden de compra - Anamin Group,pdf.exe
Size 1.1MB
Sample210820-pgbbtz9582
SHA256 8dd453814cc59ecb7918da706244b3e8aacc66146b9ff80bcad195e066464139
MD5 e17afaa832a1b59168ad87a146ece5b4
SHA1 cabb2d38201c22042ed64cd5104d101acde454c8
SHA512 9e502a35d9b83425856ad90ff6f305d3613ec654085b1ea048264e7f2bee2187585eb783fcda06c71e33bb974384e34709f77db33ca8b786b8931cf3392d7228
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pvlrdrs = "C:\\Users\\Public\\Libraries\\srdrlvP.url"	orden de compra - Anamin Group,pdf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	1840	WerFault.exe	31

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1964	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	WerFault.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	31
PID 1840 wrote to memory of 1964	1840	mshta.exe	32
PID 1840 wrote to memory of 1964	1840	mshta.exe	32
PID 1840 wrote to memory of 1964	1840	mshta.exe	32
PID 1840 wrote to memory of 1964	1840	mshta.exe	32

C:\Users\Admin\AppData\Local\Temp\orden de compra - Anamin Group,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\orden de compra - Anamin Group,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\mshta.exe
  C:\Windows\System32\mshta.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 136
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-68-0x00000000002E0000-0x00000000002E1000-memory.dmp

Download

memory/1840-67-0x00000000000C0000-0x00000000000C1000-memory.dmp

Download

memory/1840-66-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/1840-69-0x0000000010590000-0x000000001060D000-memory.dmp

Download

memory/1964-70-0x0000000000350000-0x0000000000351000-memory.dmp

Download

memory/2020-60-0x0000000076A81000-0x0000000076A83000-memory.dmp

Download

memory/2020-61-0x00000000003B0000-0x00000000003B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads