Analysis
- max time kernel
134s - max time network
136s - platform
windows7_x64 - resource
win7v20210408 - submitted
27/09/2021, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe
- Size 985KB
- Sample210927-swcxeahddj
- SHA256 37cc8d06cb1500b90001e9307464c2f7a2d603c54ef604db7b840b635900d365
- MD5 93bc502c19f1b3499d86f67f95689d90
- SHA1 67316d2fa690e110668fe7d1a78ae5615bd03ea5
- SHA512 abcade0008dcd5414466637e50ddbb4ada2db8352ec93b1de7db72948102a67f66ddaa8cfab4804828b7edff1a538a1a83147dbd8d33c8f64dda9663fbc67751
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hqkwpjo = "C:\\Users\\Public\\Libraries\\ojpwkqH.url" PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe - Program crash 1 IoCs
pid pid_target Process procid_target 868 1144 WerFault.exe 29 - Modifies registry key 1 TTPs 3 IoCs
pid Process 464 reg.exe 1516 reg.exe 1756 reg.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 868 WerFault.exe 868 WerFault.exe 868 WerFault.exe 868 WerFault.exe 868 WerFault.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 868 WerFault.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 868 WerFault.exe - Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1144 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 29 PID 368 wrote to memory of 1312 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 30 PID 368 wrote to memory of 1312 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 30 PID 368 wrote to memory of 1312 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 30 PID 368 wrote to memory of 1312 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 30 PID 1144 wrote to memory of 868 1144 secinit.exe 32 PID 1144 wrote to memory of 868 1144 secinit.exe 32 PID 1144 wrote to memory of 868 1144 secinit.exe 32 PID 1144 wrote to memory of 868 1144 secinit.exe 32 PID 1312 wrote to memory of 1368 1312 cmd.exe 33 PID 1312 wrote to memory of 1368 1312 cmd.exe 33 PID 1312 wrote to memory of 1368 1312 cmd.exe 33 PID 1312 wrote to memory of 1368 1312 cmd.exe 33 PID 1368 wrote to memory of 464 1368 cmd.exe 35 PID 1368 wrote to memory of 464 1368 cmd.exe 35 PID 1368 wrote to memory of 464 1368 cmd.exe 35 PID 1368 wrote to memory of 464 1368 cmd.exe 35 PID 1368 wrote to memory of 1516 1368 cmd.exe 36 PID 1368 wrote to memory of 1516 1368 cmd.exe 36 PID 1368 wrote to memory of 1516 1368 cmd.exe 36 PID 1368 wrote to memory of 1516 1368 cmd.exe 36 PID 1368 wrote to memory of 640 1368 cmd.exe 37 PID 1368 wrote to memory of 640 1368 cmd.exe 37 PID 1368 wrote to memory of 640 1368 cmd.exe 37 PID 1368 wrote to memory of 640 1368 cmd.exe 37 PID 368 wrote to memory of 1916 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 38 PID 368 wrote to memory of 1916 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 38 PID 368 wrote to memory of 1916 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 38 PID 368 wrote to memory of 1916 368 PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe 38 PID 1916 wrote to memory of 1756 1916 cmd.exe 40 PID 1916 wrote to memory of 1756 1916 cmd.exe 40 PID 1916 wrote to memory of 1756 1916 cmd.exe 40 PID 1916 wrote to memory of 1756 1916 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\secinit.exe"C:\Windows\System32\secinit.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 1723⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\Trast.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:464
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:1516
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:640
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\nest.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f3⤵
- Modifies registry key
PID:1756
-
-