Analysis

  • max time kernel
    139s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    30-09-2021 04:05

General

  • Target

    Nuevo orden e imagen.exe

  • Size

    336KB

  • MD5

    d60289c2fddd1b5e32e83e653ef587cc

  • SHA1

    011bc4097190adcaa3902842bbffd9ab582be832

  • SHA256

    e7d4b1fb8d668e0b01943e63024f65809c6f1ee73ebcc8a969970a29138d85b0

  • SHA512

    43318e4fd0ec88bdc43a412a0dea4be079c5dac6414c829140b5dfbc05c83a5eab823a69d1d47fbe730af687cd16cb5a3b7fd93125cb82afe4f61dec4df4d398

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nuevo orden e imagen.exe
    "C:\Users\Admin\AppData\Local\Temp\Nuevo orden e imagen.exe"
    1⤵
      PID:2372
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 240
        2⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2672

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2372-115-0x0000000000570000-0x00000000006BA000-memory.dmp
      Filesize

      1.3MB