8dd453814cc59ecb7918da706244b3e8aacc66146b9ff80bcad195e066464139

General

Target

orden de compra - Anamin Group,pdf.exe
Size

1.1MB
MD5

e17afaa832a1b59168ad87a146ece5b4
SHA1

cabb2d38201c22042ed64cd5104d101acde454c8
SHA256

8dd453814cc59ecb7918da706244b3e8aacc66146b9ff80bcad195e066464139
SHA512

9e502a35d9b83425856ad90ff6f305d3613ec654085b1ea048264e7f2bee2187585eb783fcda06c71e33bb974384e34709f77db33ca8b786b8931cf3392d7228

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

orden de compra - Anamin Group,pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pvlrdrs = "C:\\Users\\Public\\Libraries\\srdrlvP.url"	orden de compra - Anamin Group,pdf.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1964 1840 WerFault.exe mshta.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1964 WerFault.exe
1964 WerFault.exe
1964 WerFault.exe
1964 WerFault.exe
1964 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1964 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1964 WerFault.exe

pid	pid_target	process	target process
1964	1840	WerFault.exe	mshta.exe

pid	process
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe

pid	process
1964	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1964	WerFault.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

orden de compra - Anamin Group,pdf.exemshta.exe

description	pid	process	target process
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 2020 wrote to memory of 1840	2020	orden de compra - Anamin Group,pdf.exe	mshta.exe
PID 1840 wrote to memory of 1964	1840	mshta.exe	WerFault.exe
PID 1840 wrote to memory of 1964	1840	mshta.exe	WerFault.exe
PID 1840 wrote to memory of 1964	1840	mshta.exe	WerFault.exe
PID 1840 wrote to memory of 1964	1840	mshta.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\orden de compra - Anamin Group,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\orden de compra - Anamin Group,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\mshta.exe
C:\Windows\System32\mshta.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 136
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-62-0x0000000000000000-mapping.dmp

Download
memory/1840-68-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1840-67-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1840-66-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1840-69-0x0000000010590000-0x000000001060D000-memory.dmp

Filesize
500KB

Download
memory/1964-64-0x0000000000000000-mapping.dmp

Download
memory/1964-70-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2020-60-0x0000000076A81000-0x0000000076A83000-memory.dmp

Filesize
8KB

Download
memory/2020-61-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing