Analysis
-
max time kernel
4294419s -
max time network
363s -
platform
windows7_x64 -
resource
win7-20220311-es -
submitted
16-03-2022 17:27
Static task
static1
Behavioral task
behavioral1
Sample
Lista de orden?.0927272829229.PDF.exe
Resource
win7-20220311-es
windows7_x64
0 signatures
0 seconds
General
-
Target
Lista de orden?.0927272829229.PDF.exe
-
Size
683KB
-
MD5
5879dcb6632d8c3d53f39a29e86cdcce
-
SHA1
97c358a006711c52a4647c3db520a9fdb575e952
-
SHA256
a84bdf209b862ffbdf3d963611eec3c1c2d70024e24041727a49bc618d6ff4cd
-
SHA512
80778f7cfdea1f20b8a44a4633558dfc22475cadeb54b9477cb739d59f85c70a26b8b9dab84c62347d719438849cb91ef0da8de174af022c09b87d2a06c6d4eb
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Lista de orden_.0927272829229.PDF.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pgkotdp = "C:\\Users\\Public\\pdtokgP.url" Lista de orden_.0927272829229.PDF.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1276 980 WerFault.exe logagent.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Lista de orden_.0927272829229.PDF.exelogagent.exedescription pid process target process PID 2012 wrote to memory of 980 2012 Lista de orden_.0927272829229.PDF.exe logagent.exe PID 2012 wrote to memory of 980 2012 Lista de orden_.0927272829229.PDF.exe logagent.exe PID 2012 wrote to memory of 980 2012 Lista de orden_.0927272829229.PDF.exe logagent.exe PID 2012 wrote to memory of 980 2012 Lista de orden_.0927272829229.PDF.exe logagent.exe PID 2012 wrote to memory of 980 2012 Lista de orden_.0927272829229.PDF.exe logagent.exe PID 2012 wrote to memory of 980 2012 Lista de orden_.0927272829229.PDF.exe logagent.exe PID 2012 wrote to memory of 980 2012 Lista de orden_.0927272829229.PDF.exe logagent.exe PID 980 wrote to memory of 1276 980 logagent.exe WerFault.exe PID 980 wrote to memory of 1276 980 logagent.exe WerFault.exe PID 980 wrote to memory of 1276 980 logagent.exe WerFault.exe PID 980 wrote to memory of 1276 980 logagent.exe WerFault.exe
Processes
-
C:\Program Files\Mozilla Firefox\default-browser-agent.exe"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task1⤵
-
C:\Users\Admin\AppData\Local\Temp\Lista de orden_.0927272829229.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Lista de orden_.0927272829229.PDF.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 1403⤵
- Program crash
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/980-60-0x0000000072480000-0x00000000724AE000-memory.dmpFilesize
184KB
-
memory/980-62-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1844-57-0x000007FEFC0A1000-0x000007FEFC0A3000-memory.dmpFilesize
8KB
-
memory/2012-54-0x00000000767D1000-0x00000000767D3000-memory.dmpFilesize
8KB
-
memory/2012-56-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2012-59-0x0000000003EC6000-0x0000000003EC7000-memory.dmpFilesize
4KB