Analysis
-
max time kernel
4294182s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
20-03-2022 09:58
Static task
static1
Behavioral task
behavioral1
Sample
Adjunto orden de compra.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
General
-
Target
Adjunto orden de compra.exe
-
Size
1.1MB
-
MD5
20f7d95a5ff1ad22ebabc1037556c014
-
SHA1
25c25c70ba0e88f4952fb739df0e9d48896b71fd
-
SHA256
1b931e14bdbf51c88c98a13c7f934dd3c9e8e1b8583d8d95129e1a0b3a03eece
-
SHA512
11f5431d648eccbd3234a4b325a4ce9adea021c28ed144bc1f8e55d47ce99ef9910266b7d6c7cfdb9eb5ede7512e25ae4ee8a09a9ae7b3e653c2c04b205b153f
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Adjunto orden de compra.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pbadbrs = "C:\\Users\\Public\\srbdabP.url" Adjunto orden de compra.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1976 1476 WerFault.exe logagent.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Adjunto orden de compra.exelogagent.exedescription pid process target process PID 1804 wrote to memory of 1476 1804 Adjunto orden de compra.exe logagent.exe PID 1804 wrote to memory of 1476 1804 Adjunto orden de compra.exe logagent.exe PID 1804 wrote to memory of 1476 1804 Adjunto orden de compra.exe logagent.exe PID 1804 wrote to memory of 1476 1804 Adjunto orden de compra.exe logagent.exe PID 1804 wrote to memory of 1476 1804 Adjunto orden de compra.exe logagent.exe PID 1804 wrote to memory of 1476 1804 Adjunto orden de compra.exe logagent.exe PID 1804 wrote to memory of 1476 1804 Adjunto orden de compra.exe logagent.exe PID 1476 wrote to memory of 1976 1476 logagent.exe WerFault.exe PID 1476 wrote to memory of 1976 1476 logagent.exe WerFault.exe PID 1476 wrote to memory of 1976 1476 logagent.exe WerFault.exe PID 1476 wrote to memory of 1976 1476 logagent.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Adjunto orden de compra.exe"C:\Users\Admin\AppData\Local\Temp\Adjunto orden de compra.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 1403⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1476-59-0x0000000072480000-0x00000000724AE000-memory.dmpFilesize
184KB
-
memory/1476-61-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1804-54-0x00000000759C1000-0x00000000759C3000-memory.dmpFilesize
8KB
-
memory/1804-55-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1804-58-0x00000000045E6000-0x00000000045E7000-memory.dmpFilesize
4KB