Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 14:29
Static task
static1
Behavioral task
behavioral1
Sample
nuevo pedido.docx.rar
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
nuevo pedido.docx.rar
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
nuevo pedido.docx.exe
Resource
win7-20220812-en
General
-
Target
nuevo pedido.docx.rar
-
Size
852KB
-
MD5
99eabaf54c28eaf8bc9a910bd27d15bf
-
SHA1
7dbad624f6ac9dd056cf7b4d7bdcb8c5c6309b4e
-
SHA256
4b8ac2523efa7356d9f5638ac54a2ebe757f2ff439cbbfe5ca5326328dcc1510
-
SHA512
8e296126b78d86fc74eaff309ab1e4fc3184d4f9839258c4e47bd7342d6796003ca52acbbc3d9c64c9c7de68be9b7451a8d0f8e6d65e1e3172d42cc3bc8d1792
-
SSDEEP
24576:+Mp23FDeNJCy9q7BGLKtnoOhhxBGkISM65eqLv:BWD9zrhLn
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 1300 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 1300 vlc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
vlc.exepid process 1300 vlc.exe 1300 vlc.exe 1300 vlc.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
vlc.exepid process 1300 vlc.exe 1300 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 1300 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1436 wrote to memory of 996 1436 cmd.exe rundll32.exe PID 1436 wrote to memory of 996 1436 cmd.exe rundll32.exe PID 1436 wrote to memory of 996 1436 cmd.exe rundll32.exe PID 996 wrote to memory of 1300 996 rundll32.exe vlc.exe PID 996 wrote to memory of 1300 996 rundll32.exe vlc.exe PID 996 wrote to memory of 1300 996 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\nuevo pedido.docx.rar"1⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\nuevo pedido.docx.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\nuevo pedido.docx.rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1300