Overview

overview

4

Static

static

1

Solicitar ...�n.rar

windows10-1703-x64

4

Resubmissions

23/03/2023, 17:55

230323-whn93abc2w 3

23/03/2023, 17:50

230323-we39tabb9w 4

23/03/2023, 17:45

230323-wb42yahc35 4

23/03/2023, 17:43

230323-wapkvshc27 3

23/03/2023, 17:41

230323-v9he6ahc22 1

Analysis

  • max time kernel
    135s
  • max time network
    73s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-es
  • resource tags

    arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    23/03/2023, 17:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Solicitar Cotización.rar

  • Size

    718KB

  • MD5

    8d8f2fc8051dbb1143da9700013bd4d7

  • SHA1

    6bc659f9d097cac792f029f28761df88a954d822

  • SHA256

    dabb83dc8b5700dcd8458558d945e71145bf83564c58b020d913f7929289a214

  • SHA512

    c02dd3377a78671efaaaed7d648625b94aa168931ca85f906682da0f614e26097ac91460b08fa58cfbc07d00b36e61aa0f60e0acdd65d98fdda18f9ffdea187d

  • SSDEEP

    12288:EXftIvcf1jC0uYfFZ3ZmMhNRqBck38lxrgx9fkq9upf/ZpOX0xK6xiPu:cfSv+O0uY8MBKAgx1uZOMLN

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Solicitar Cotización.rar"
    1⤵
    • Modifies registry class
    PID:632
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Program Files\7-Zip\7z.exe
      "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitar Cotización.rar"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4144
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /0
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3828

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads