71cd3e3afcd5a2df4cc2092f8724b24c6a8cc7e6f44f77cc8174dac0a565f98b

Analysis

max time kernel
151s
max time network
141s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/01/2022, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nuevo pedido#23785.exe
Size 430KB
Sample220124-m849jaedb8
SHA256 71cd3e3afcd5a2df4cc2092f8724b24c6a8cc7e6f44f77cc8174dac0a565f98b
MD5 45fe143aec6a446a2bfec96054dc923c
SHA1 a00719ef783406b10e44962ee6869e6a6fcc9e0d
SHA512 97967ad8de22d724541b985e0beb9ac68a5bfd2884df5d408fca79318dd9259e801dcfbddaacaf34bdc25128a1a00af78230bf818ce5c24b1ae3b18c545e540b
MD5 SHA1 SHA512

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nuevo pedido#23785.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nuevo pedido#23785.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	nuevo pedido#23785.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	nuevo pedido#23785.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	nuevo pedido#23785.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	nuevo pedido#23785.exe

Program crash 36 IoCs

pid	pid_target	Process	procid_target
352	356	WerFault.exe	71
1564	2904	WerFault.exe	74
1420	1556	WerFault.exe	76
424	440	WerFault.exe	78
2716	3232	WerFault.exe	80
1156	2244	WerFault.exe	84
1496	1380	WerFault.exe	86
1656	1692	WerFault.exe	88
2132	3492	WerFault.exe	90
2084	2148	WerFault.exe	92
2260	3176	WerFault.exe	94
3640	3036	WerFault.exe	96
4040	2268	WerFault.exe	98
1544	1048	WerFault.exe	100
2336	972	WerFault.exe	102
1832	1676	WerFault.exe	104
2528	68	WerFault.exe	106
3576	3484	WerFault.exe	108
3132	3512	WerFault.exe	110
2408	3188	WerFault.exe	112
1308	2160	WerFault.exe	114
3852	3828	WerFault.exe	116
1016	3752	WerFault.exe	118
1816	3104	WerFault.exe	120
2956	2232	WerFault.exe	122
300	4020	WerFault.exe	124
872	2524	WerFault.exe	126
3292	3268	WerFault.exe	128
1416	1456	WerFault.exe	130
3952	1540	WerFault.exe	132
1172	1460	WerFault.exe	134
2712	704	WerFault.exe	136
2972	3716	WerFault.exe	138
3796	1840	WerFault.exe	140
1480	2416	WerFault.exe	142
1588	3552	WerFault.exe	144

Suspicious use of SetThreadContext 37 IoCs

description	pid	Process	procid_target
PID 3556 set thread context of 3140	3556	nuevo pedido#23785.exe	70
PID 3140 set thread context of 356	3140	nuevo pedido#23785.exe	71
PID 3140 set thread context of 2904	3140	nuevo pedido#23785.exe	74
PID 3140 set thread context of 1556	3140	nuevo pedido#23785.exe	76
PID 3140 set thread context of 440	3140	nuevo pedido#23785.exe	78
PID 3140 set thread context of 3232	3140	nuevo pedido#23785.exe	80
PID 3140 set thread context of 2244	3140	nuevo pedido#23785.exe	84
PID 3140 set thread context of 1380	3140	nuevo pedido#23785.exe	86
PID 3140 set thread context of 1692	3140	nuevo pedido#23785.exe	88
PID 3140 set thread context of 3492	3140	nuevo pedido#23785.exe	90
PID 3140 set thread context of 2148	3140	nuevo pedido#23785.exe	92
PID 3140 set thread context of 3176	3140	nuevo pedido#23785.exe	94
PID 3140 set thread context of 3036	3140	nuevo pedido#23785.exe	96
PID 3140 set thread context of 2268	3140	nuevo pedido#23785.exe	98
PID 3140 set thread context of 1048	3140	nuevo pedido#23785.exe	100
PID 3140 set thread context of 972	3140	nuevo pedido#23785.exe	102
PID 3140 set thread context of 1676	3140	nuevo pedido#23785.exe	104
PID 3140 set thread context of 68	3140	nuevo pedido#23785.exe	106
PID 3140 set thread context of 3484	3140	nuevo pedido#23785.exe	108
PID 3140 set thread context of 3512	3140	nuevo pedido#23785.exe	110
PID 3140 set thread context of 3188	3140	nuevo pedido#23785.exe	112
PID 3140 set thread context of 2160	3140	nuevo pedido#23785.exe	114
PID 3140 set thread context of 3828	3140	nuevo pedido#23785.exe	116
PID 3140 set thread context of 3752	3140	nuevo pedido#23785.exe	118
PID 3140 set thread context of 3104	3140	nuevo pedido#23785.exe	120
PID 3140 set thread context of 2232	3140	nuevo pedido#23785.exe	122
PID 3140 set thread context of 4020	3140	nuevo pedido#23785.exe	124
PID 3140 set thread context of 2524	3140	nuevo pedido#23785.exe	126
PID 3140 set thread context of 3268	3140	nuevo pedido#23785.exe	128
PID 3140 set thread context of 1456	3140	nuevo pedido#23785.exe	130
PID 3140 set thread context of 1540	3140	nuevo pedido#23785.exe	132
PID 3140 set thread context of 1460	3140	nuevo pedido#23785.exe	134
PID 3140 set thread context of 704	3140	nuevo pedido#23785.exe	136
PID 3140 set thread context of 3716	3140	nuevo pedido#23785.exe	138
PID 3140 set thread context of 1840	3140	nuevo pedido#23785.exe	140
PID 3140 set thread context of 2416	3140	nuevo pedido#23785.exe	142
PID 3140 set thread context of 3552	3140	nuevo pedido#23785.exe	144

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe
3140	nuevo pedido#23785.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3140	nuevo pedido#23785.exe

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
972	iexplore.exe
972	iexplore.exe
972	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 3140	3556	nuevo pedido#23785.exe	70
PID 3556 wrote to memory of 3140	3556	nuevo pedido#23785.exe	70
PID 3556 wrote to memory of 3140	3556	nuevo pedido#23785.exe	70
PID 3556 wrote to memory of 3140	3556	nuevo pedido#23785.exe	70
PID 3556 wrote to memory of 3140	3556	nuevo pedido#23785.exe	70
PID 3556 wrote to memory of 3140	3556	nuevo pedido#23785.exe	70
PID 3556 wrote to memory of 3140	3556	nuevo pedido#23785.exe	70
PID 3140 wrote to memory of 356	3140	nuevo pedido#23785.exe	71
PID 3140 wrote to memory of 356	3140	nuevo pedido#23785.exe	71
PID 3140 wrote to memory of 356	3140	nuevo pedido#23785.exe	71
PID 3140 wrote to memory of 356	3140	nuevo pedido#23785.exe	71
PID 3140 wrote to memory of 356	3140	nuevo pedido#23785.exe	71
PID 3140 wrote to memory of 356	3140	nuevo pedido#23785.exe	71
PID 3140 wrote to memory of 356	3140	nuevo pedido#23785.exe	71
PID 3140 wrote to memory of 356	3140	nuevo pedido#23785.exe	71
PID 3140 wrote to memory of 2904	3140	nuevo pedido#23785.exe	74
PID 3140 wrote to memory of 2904	3140	nuevo pedido#23785.exe	74
PID 3140 wrote to memory of 2904	3140	nuevo pedido#23785.exe	74
PID 3140 wrote to memory of 2904	3140	nuevo pedido#23785.exe	74
PID 3140 wrote to memory of 2904	3140	nuevo pedido#23785.exe	74
PID 3140 wrote to memory of 2904	3140	nuevo pedido#23785.exe	74
PID 3140 wrote to memory of 2904	3140	nuevo pedido#23785.exe	74
PID 3140 wrote to memory of 2904	3140	nuevo pedido#23785.exe	74
PID 3140 wrote to memory of 1556	3140	nuevo pedido#23785.exe	76
PID 3140 wrote to memory of 1556	3140	nuevo pedido#23785.exe	76
PID 3140 wrote to memory of 1556	3140	nuevo pedido#23785.exe	76
PID 3140 wrote to memory of 1556	3140	nuevo pedido#23785.exe	76
PID 3140 wrote to memory of 1556	3140	nuevo pedido#23785.exe	76
PID 3140 wrote to memory of 1556	3140	nuevo pedido#23785.exe	76
PID 3140 wrote to memory of 1556	3140	nuevo pedido#23785.exe	76
PID 3140 wrote to memory of 1556	3140	nuevo pedido#23785.exe	76
PID 3140 wrote to memory of 440	3140	nuevo pedido#23785.exe	78
PID 3140 wrote to memory of 440	3140	nuevo pedido#23785.exe	78
PID 3140 wrote to memory of 440	3140	nuevo pedido#23785.exe	78
PID 3140 wrote to memory of 440	3140	nuevo pedido#23785.exe	78
PID 3140 wrote to memory of 440	3140	nuevo pedido#23785.exe	78
PID 3140 wrote to memory of 440	3140	nuevo pedido#23785.exe	78
PID 3140 wrote to memory of 440	3140	nuevo pedido#23785.exe	78
PID 3140 wrote to memory of 440	3140	nuevo pedido#23785.exe	78
PID 3140 wrote to memory of 3232	3140	nuevo pedido#23785.exe	80
PID 3140 wrote to memory of 3232	3140	nuevo pedido#23785.exe	80
PID 3140 wrote to memory of 3232	3140	nuevo pedido#23785.exe	80
PID 3140 wrote to memory of 3232	3140	nuevo pedido#23785.exe	80
PID 3140 wrote to memory of 3232	3140	nuevo pedido#23785.exe	80
PID 3140 wrote to memory of 3232	3140	nuevo pedido#23785.exe	80
PID 3140 wrote to memory of 3232	3140	nuevo pedido#23785.exe	80
PID 3140 wrote to memory of 3232	3140	nuevo pedido#23785.exe	80
PID 3140 wrote to memory of 2244	3140	nuevo pedido#23785.exe	84
PID 3140 wrote to memory of 2244	3140	nuevo pedido#23785.exe	84
PID 3140 wrote to memory of 2244	3140	nuevo pedido#23785.exe	84
PID 3140 wrote to memory of 2244	3140	nuevo pedido#23785.exe	84
PID 3140 wrote to memory of 2244	3140	nuevo pedido#23785.exe	84
PID 3140 wrote to memory of 2244	3140	nuevo pedido#23785.exe	84
PID 3140 wrote to memory of 2244	3140	nuevo pedido#23785.exe	84
PID 3140 wrote to memory of 2244	3140	nuevo pedido#23785.exe	84
PID 3140 wrote to memory of 1380	3140	nuevo pedido#23785.exe	86
PID 3140 wrote to memory of 1380	3140	nuevo pedido#23785.exe	86
PID 3140 wrote to memory of 1380	3140	nuevo pedido#23785.exe	86
PID 3140 wrote to memory of 1380	3140	nuevo pedido#23785.exe	86
PID 3140 wrote to memory of 1380	3140	nuevo pedido#23785.exe	86
PID 3140 wrote to memory of 1380	3140	nuevo pedido#23785.exe	86
PID 3140 wrote to memory of 1380	3140	nuevo pedido#23785.exe	86
PID 3140 wrote to memory of 1380	3140	nuevo pedido#23785.exe	86
PID 3140 wrote to memory of 1692	3140	nuevo pedido#23785.exe	88

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	nuevo pedido#23785.exe

C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
"C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
  "C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe"
  2⤵
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3140
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:356
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 356 -s 24
      4⤵
      Program crash
      PID:352
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:2904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 24
      4⤵
      Program crash
      PID:1564
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:1556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 24
      4⤵
      Program crash
      PID:1420
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 24
      4⤵
      Program crash
      PID:424
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 24
      4⤵
      Program crash
      PID:2716
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:2244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 24
      4⤵
      Program crash
      PID:1156
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:1380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 24
      4⤵
      Program crash
      PID:1496
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:1692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 24
      4⤵
      Program crash
      PID:1656
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 24
      4⤵
      Program crash
      PID:2132
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:2148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 24
      4⤵
      Program crash
      PID:2084
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 24
      4⤵
      Program crash
      PID:2260
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 24
      4⤵
      Program crash
      PID:3640
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:2268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 24
      4⤵
      Program crash
      PID:4040
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:1048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 24
      4⤵
      Program crash
      PID:1544
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 24
      4⤵
      Program crash
      PID:2336
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:1676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 24
      4⤵
      Program crash
      PID:1832
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:68
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 68 -s 24
      4⤵
      Program crash
      PID:2528
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 24
      4⤵
      Program crash
      PID:3576
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 24
      4⤵
      Program crash
      PID:3132
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 24
      4⤵
      Program crash
      PID:2408
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:2160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 24
      4⤵
      Program crash
      PID:1308
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 24
      4⤵
      Program crash
      PID:3852
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 24
      4⤵
      Program crash
      PID:1016
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 24
      4⤵
      Program crash
      PID:1816
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:2232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 24
      4⤵
      Program crash
      PID:2956
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:4020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 24
      4⤵
      Program crash
      PID:300
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:2524
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 24
      4⤵
      Program crash
      PID:872
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 24
      4⤵
      Program crash
      PID:3292
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:1456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 24
      4⤵
      Program crash
      PID:1416
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:1540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 24
      4⤵
      Program crash
      PID:3952
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:1460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 24
      4⤵
      Program crash
      PID:1172
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 24
      4⤵
      Program crash
      PID:2712
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3716
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 24
      4⤵
      Program crash
      PID:2972
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:1840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 24
      4⤵
      Program crash
      PID:3796
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:2416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 24
      4⤵
      Program crash
      PID:1480
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\nuevo pedido#23785.exe
    3⤵
    PID:3552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 24
      4⤵
      Program crash
      PID:1588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3140-125-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3140-132-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3556-115-0x0000000000060000-0x00000000000D2000-memory.dmp

Download

memory/3556-116-0x0000000004DB0000-0x00000000052AE000-memory.dmp

Download

memory/3556-117-0x0000000004950000-0x00000000049E2000-memory.dmp

Download

memory/3556-118-0x0000000004920000-0x000000000492A000-memory.dmp

Download

memory/3556-119-0x00000000048B0000-0x0000000004DAE000-memory.dmp

Download

memory/3556-120-0x00000000054A0000-0x000000000553C000-memory.dmp

Download

memory/3556-121-0x0000000005410000-0x000000000541E000-memory.dmp

Download

memory/3556-122-0x000000007EF80000-0x000000007EF81000-memory.dmp

Download

memory/3556-123-0x00000000058D0000-0x0000000005932000-memory.dmp

Download

memory/3556-124-0x00000000059A0000-0x0000000005A06000-memory.dmp

Download