Resubmissions
15-03-2023 05:44
230315-ge8f7sbg62 615-03-2023 00:20
230315-am19jaaf39 614-03-2023 05:55
230314-gmnf1afh4v 3Analysis
-
max time kernel
291s -
max time network
296s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-es -
resource tags
-
submitted
15-03-2023 00:20
General
-
Target
PDF_Archivo_DocumtoYCNCFQUFIICMOHQgyezk.exe
-
Size
313.5MB
-
MD5
07f42c9c9094240d7fdc4e58ce7eeffd
-
SHA1
e6e291b5c9d8eaf6ccaadbbb2ad2092750a38584
-
SHA256
d524e75f3fd6aa2f59b335384a029e1cfff62def68bcf7cf9d7cd9d39ff704df
-
SHA512
c73a971a0aea6029a2b1a95fe2033017f5b0df183d3ad92b902055871e82093d2a0f873ccd7e9cc59bb64ad5cc09d4a0415f6eebc3d03a6d12b991b484a122bd
-
SSDEEP
49152:P7WDb5p9VUKuGTrSbMEqxmm1jjV5zKSUKFHK7VKM+PIMUoEWLX6j6HNaVIT6TL1Q:P7WnXJL1nPWRVx+PIOHNq1cpJQ
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PDF_Archivo_DocumtoYCNCFQUFIICMOHQgyezk.exe"C:\Users\Admin\AppData\Local\Temp\PDF_Archivo_DocumtoYCNCFQUFIICMOHQgyezk.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB