Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2023 12:00
Static task
static1
Behavioral task
behavioral1
Sample
0089789Nuevo orden.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
0089789Nuevo orden.exe
Resource
win10v2004-20231130-en
General
-
Target
0089789Nuevo orden.exe
-
Size
849KB
-
MD5
1177200ba703d00a87eb6114e68972c8
-
SHA1
98a40d14dc7d3962cc7aae7e98af7f8f8aa5ea2f
-
SHA256
62af6b2f03773a1f7e3c92cfec408e2068adbd89d4e083ebe0ae90f8ed432c07
-
SHA512
e53e16233458b2f2bd1fc2018143a32922a83df16a19a944988103d42871ef95063a8c5bd0a891bdc1a5fe1daf46b36209a0583c771e4bdfe6202e4fab0babc6
-
SSDEEP
24576:1WNiEg7cFdwi2uzqVQRUGN6GlwjtAfXbgypW:6yYgQRUGwGyjtA/9pW
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
0089789Nuevo orden.exepid process 4500 0089789Nuevo orden.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
0089789Nuevo orden.exemsbuild.exepid process 4500 0089789Nuevo orden.exe 2032 msbuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0089789Nuevo orden.exedescription pid process target process PID 4500 set thread context of 2032 4500 0089789Nuevo orden.exe msbuild.exe -
Drops file in Program Files directory 1 IoCs
Processes:
0089789Nuevo orden.exedescription ioc process File opened for modification C:\Program Files (x86)\victorianerne\censorial\statuetternes\indgrebskriterium\sljfningers.ini 0089789Nuevo orden.exe -
Drops file in Windows directory 1 IoCs
Processes:
0089789Nuevo orden.exedescription ioc process File opened for modification C:\Windows\Fonts\megarhyssa\Bromometry\allerpopulreste\Croissanter.ini 0089789Nuevo orden.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0089789Nuevo orden.exepid process 4500 0089789Nuevo orden.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
0089789Nuevo orden.exedescription pid process target process PID 4500 wrote to memory of 2032 4500 0089789Nuevo orden.exe msbuild.exe PID 4500 wrote to memory of 2032 4500 0089789Nuevo orden.exe msbuild.exe PID 4500 wrote to memory of 2032 4500 0089789Nuevo orden.exe msbuild.exe PID 4500 wrote to memory of 2032 4500 0089789Nuevo orden.exe msbuild.exe PID 4500 wrote to memory of 2032 4500 0089789Nuevo orden.exe msbuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0089789Nuevo orden.exe"C:\Users\Admin\AppData\Local\Temp\0089789Nuevo orden.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Users\Admin\AppData\Local\Temp\0089789Nuevo orden.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4