Analysis
-
max time kernel
139s -
max time network
131s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
01-10-2021 11:23
Static task
static1
Behavioral task
behavioral1
Sample
Lista de ordenes de compra.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Lista de ordenes de compra.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
Lista de ordenes de compra.exe
-
Size
653KB
-
MD5
a8732c40f2c0e569f938a59e0ccb8130
-
SHA1
1b4683cec4d54b3217b10d3a4908537ce52a9808
-
SHA256
9c558e9f026119bab2580c1e38533870d351b1e01e65341427194504e2cdf490
-
SHA512
e3241131f6f101c1113cf3802a1619736a4fc135c7bb69d3b97605e57bb5554b1b06fba060662cb46d47a63d12a04d58ae44382f28733922b1e4523b25a2b5d0
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4040 2572 WerFault.exe mobsync.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 4040 WerFault.exe 4040 WerFault.exe 4040 WerFault.exe 4040 WerFault.exe 4040 WerFault.exe 4040 WerFault.exe 4040 WerFault.exe 4040 WerFault.exe 4040 WerFault.exe 4040 WerFault.exe 4040 WerFault.exe 4040 WerFault.exe 4040 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4040 WerFault.exe Token: SeBackupPrivilege 4040 WerFault.exe Token: SeDebugPrivilege 4040 WerFault.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Lista de ordenes de compra.exedescription pid process target process PID 2372 wrote to memory of 2572 2372 Lista de ordenes de compra.exe mobsync.exe PID 2372 wrote to memory of 2572 2372 Lista de ordenes de compra.exe mobsync.exe PID 2372 wrote to memory of 2572 2372 Lista de ordenes de compra.exe mobsync.exe PID 2372 wrote to memory of 2572 2372 Lista de ordenes de compra.exe mobsync.exe PID 2372 wrote to memory of 2572 2372 Lista de ordenes de compra.exe mobsync.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lista de ordenes de compra.exe"C:\Users\Admin\AppData\Local\Temp\Lista de ordenes de compra.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\mobsync.exeC:\Windows\System32\mobsync.exe2⤵PID:2572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 4683⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4040