656f08f66aac9f481e1403076c0e88732309d9dc8fe7fba6f1adc4c8e4488f7d

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-03-2023 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

orden de ##compra.rar
Size

429KB
MD5

184ee15738a3057a38833e3b4fbb522a
SHA1

a9efde6409144686905e5d3945c26f77a7380bb1
SHA256

e3d6bd35558702ac5335dc818b6bb8a576f1ade7c5963667a600ca0a5f3267ec
SHA512

54f59ebc7a27c9bf584e5576b6927b6d90237aba7ea81987756688722e59c7ecd81213f66374d27171ff06180e8be0231059ed3d903f52bfcef9fc21242ad3e5
SSDEEP

12288:IaQVM8LHmtGdrX0J4maBtiqFnvi7rvUUu9Vd:QVMSrX04BtTFnq7r81v

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1992 wrote to memory of 268	1992	cmd.exe	rundll32.exe
PID 1992 wrote to memory of 268	1992	cmd.exe	rundll32.exe
PID 1992 wrote to memory of 268	1992	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\orden de ##compra.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\orden de ##compra.rar
2⤵
- Modifies registry class
PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads