d14d37848f622f44182e8f6788e4a769648c8e301fa485a7b0a3a6f72102aa80

Analysis

max time kernel
31s
max time network
35s
platform
windows7_x64
resource
win7-20230621-es
resource tags

arch:x64arch:x86image:win7-20230621-eslocale:es-esos:windows7-x64systemwindows
submitted
02/07/2023, 20:55

Target

FACT_ELECTTRONICA_CL-00618263.rar
Size

1.5MB
MD5

15fc9a639c40d0c14773c98ec9eeb2db
SHA1

869e067204cbfd05d7a43a6ac62ef26ebf94f1b3
SHA256

d14d37848f622f44182e8f6788e4a769648c8e301fa485a7b0a3a6f72102aa80
SHA512

5aa09e4da3093922ec8efc2c989190639d3cd3bab62c4f8f5c044f0ebcaceca465a1eb3db38654868aa62a148914b53de6cbd8df2a9b990513101e5252e8eded
SSDEEP

24576:Hx11C2FCOw1fel7BM+o1alh1b63WA5k0500WKB68cBbsa9yDRt+A111llDBr31hQ:Hx1Y5el7S+ma/Z3/03DFMkZ111FMhs2n

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1196	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1196	1324	cmd.exe	29
PID 1324 wrote to memory of 1196	1324	cmd.exe	29
PID 1324 wrote to memory of 1196	1324	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\FACT_ELECTTRONICA_CL-00618263.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\FACT_ELECTTRONICA_CL-00618263.rar
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1196

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact