Analysis

  • max time kernel
    33s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    05-12-2023 14:31

General

  • Target

    DOCUMENTO_NOTIFICACION_VINCULACION_PROCESO_ADELANTADOR_SECRETARIA_DE_SALUD_TURBO_POR_IRREGULARIDADES.rar

  • Size

    359KB

  • MD5

    aeff13ad45fc317d5b4ecb6cf19f6b9c

  • SHA1

    b21a0b932f17c4e111d333682d3f750199beb584

  • SHA256

    00fd2efe7e59af1a6d9909bd4acfd7e08a3f5be6f2eb2c711afd12645e8e6abb

  • SHA512

    ae8a1cc8dcf1ff9cc0851e7c29fade369a84b43372b7f32188f1d49f9ecb773b4605fc6a129bac6890da1046d8976ebff7df0607aae4c5401046f76dec0271c4

  • SSDEEP

    6144:u/9v/FFgh/rrNf1DlzpSzFqtKHd4NMTj/KuUvU0OwZYqPHLSSaJbK9ZGVZICGgnV:kCj59DJpmqtS42TrsOwuSaJWDGV4bA

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\DOCUMENTO_NOTIFICACION_VINCULACION_PROCESO_ADELANTADOR_SECRETARIA_DE_SALUD_TURBO_POR_IRREGULARIDADES.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\DOCUMENTO_NOTIFICACION_VINCULACION_PROCESO_ADELANTADOR_SECRETARIA_DE_SALUD_TURBO_POR_IRREGULARIDADES.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO_NOTIFICACION_VINCULACION_PROCESO_ADELANTADOR_SECRETARIA_DE_SALUD_TURBO_POR_IRREGULARIDADES.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2684-26-0x000000013F600000-0x000000013F6F8000-memory.dmp

    Filesize

    992KB

  • memory/2684-27-0x000007FEFB490000-0x000007FEFB4C4000-memory.dmp

    Filesize

    208KB

  • memory/2684-28-0x000007FEF6460000-0x000007FEF6714000-memory.dmp

    Filesize

    2.7MB

  • memory/2684-29-0x000007FEFB8E0000-0x000007FEFB8F8000-memory.dmp

    Filesize

    96KB

  • memory/2684-30-0x000007FEFB210000-0x000007FEFB227000-memory.dmp

    Filesize

    92KB

  • memory/2684-31-0x000007FEFB170000-0x000007FEFB181000-memory.dmp

    Filesize

    68KB

  • memory/2684-32-0x000007FEF7B30000-0x000007FEF7B47000-memory.dmp

    Filesize

    92KB

  • memory/2684-33-0x000007FEF7B00000-0x000007FEF7B11000-memory.dmp

    Filesize

    68KB

  • memory/2684-34-0x000007FEF7AE0000-0x000007FEF7AFD000-memory.dmp

    Filesize

    116KB

  • memory/2684-35-0x000007FEF7AC0000-0x000007FEF7AD1000-memory.dmp

    Filesize

    68KB

  • memory/2684-36-0x000007FEF60B0000-0x000007FEF62B0000-memory.dmp

    Filesize

    2.0MB

  • memory/2684-37-0x000007FEF7A80000-0x000007FEF7ABF000-memory.dmp

    Filesize

    252KB

  • memory/2684-38-0x000007FEF7A50000-0x000007FEF7A71000-memory.dmp

    Filesize

    132KB

  • memory/2684-39-0x000007FEF7A10000-0x000007FEF7A28000-memory.dmp

    Filesize

    96KB

  • memory/2684-40-0x000007FEF78E0000-0x000007FEF78F1000-memory.dmp

    Filesize

    68KB

  • memory/2684-41-0x000007FEF78C0000-0x000007FEF78D1000-memory.dmp

    Filesize

    68KB

  • memory/2684-42-0x000007FEF78A0000-0x000007FEF78B1000-memory.dmp

    Filesize

    68KB

  • memory/2684-43-0x000007FEF7380000-0x000007FEF739B000-memory.dmp

    Filesize

    108KB

  • memory/2684-44-0x000007FEF7360000-0x000007FEF7371000-memory.dmp

    Filesize

    68KB

  • memory/2684-45-0x000007FEF7340000-0x000007FEF7358000-memory.dmp

    Filesize

    96KB

  • memory/2684-46-0x000007FEF7310000-0x000007FEF7340000-memory.dmp

    Filesize

    192KB

  • memory/2684-47-0x000007FEF6D30000-0x000007FEF6D97000-memory.dmp

    Filesize

    412KB

  • memory/2684-48-0x000007FEF4F30000-0x000007FEF5FDB000-memory.dmp

    Filesize

    16.7MB

  • memory/2684-54-0x000007FEF4DB0000-0x000007FEF4E1F000-memory.dmp

    Filesize

    444KB

  • memory/2684-55-0x000007FEF72F0000-0x000007FEF7301000-memory.dmp

    Filesize

    68KB

  • memory/2684-56-0x000007FEF4D50000-0x000007FEF4DA6000-memory.dmp

    Filesize

    344KB

  • memory/2684-57-0x000007FEF6430000-0x000007FEF6458000-memory.dmp

    Filesize

    160KB

  • memory/2684-58-0x000007FEF4920000-0x000007FEF4944000-memory.dmp

    Filesize

    144KB

  • memory/2684-59-0x000007FEF72D0000-0x000007FEF72E7000-memory.dmp

    Filesize

    92KB

  • memory/2684-60-0x000007FEF48F0000-0x000007FEF4913000-memory.dmp

    Filesize

    140KB

  • memory/2684-61-0x000007FEF6D10000-0x000007FEF6D21000-memory.dmp

    Filesize

    68KB

  • memory/2684-62-0x000007FEF68D0000-0x000007FEF68E2000-memory.dmp

    Filesize

    72KB

  • memory/2684-64-0x000007FEF4120000-0x000007FEF4133000-memory.dmp

    Filesize

    76KB

  • memory/2684-65-0x000007FEF4100000-0x000007FEF4112000-memory.dmp

    Filesize

    72KB

  • memory/2684-63-0x000007FEF44F0000-0x000007FEF4511000-memory.dmp

    Filesize

    132KB

  • memory/2684-66-0x000007FEF3FC0000-0x000007FEF40FB000-memory.dmp

    Filesize

    1.2MB

  • memory/2684-67-0x000007FEF3D40000-0x000007FEF3D6C000-memory.dmp

    Filesize

    176KB

  • memory/2684-68-0x000007FEF3B80000-0x000007FEF3D32000-memory.dmp

    Filesize

    1.7MB

  • memory/2684-69-0x000007FEF3B20000-0x000007FEF3B7C000-memory.dmp

    Filesize

    368KB

  • memory/2684-70-0x000007FEF3B00000-0x000007FEF3B11000-memory.dmp

    Filesize

    68KB

  • memory/2684-71-0x000007FEF3A60000-0x000007FEF3AF7000-memory.dmp

    Filesize

    604KB

  • memory/2684-72-0x000007FEF3900000-0x000007FEF3912000-memory.dmp

    Filesize

    72KB

  • memory/2684-73-0x000007FEF36C0000-0x000007FEF38F1000-memory.dmp

    Filesize

    2.2MB

  • memory/2684-74-0x000007FEF3680000-0x000007FEF36B5000-memory.dmp

    Filesize

    212KB

  • memory/2684-75-0x000007FEF3650000-0x000007FEF3675000-memory.dmp

    Filesize

    148KB

  • memory/2684-76-0x000007FEF3630000-0x000007FEF3641000-memory.dmp

    Filesize

    68KB

  • memory/2684-77-0x000007FEF35C0000-0x000007FEF3621000-memory.dmp

    Filesize

    388KB

  • memory/2684-78-0x000007FEF35A0000-0x000007FEF35B1000-memory.dmp

    Filesize

    68KB

  • memory/2684-79-0x000007FEF3580000-0x000007FEF3592000-memory.dmp

    Filesize

    72KB

  • memory/2684-80-0x000007FEF3560000-0x000007FEF3573000-memory.dmp

    Filesize

    76KB

  • memory/2684-81-0x000007FEF34C0000-0x000007FEF355F000-memory.dmp

    Filesize

    636KB

  • memory/2684-82-0x000007FEF34A0000-0x000007FEF34B1000-memory.dmp

    Filesize

    68KB

  • memory/2684-83-0x000007FEF3390000-0x000007FEF3492000-memory.dmp

    Filesize

    1.0MB

  • memory/2684-84-0x000007FEF3370000-0x000007FEF3381000-memory.dmp

    Filesize

    68KB

  • memory/2684-85-0x000007FEF31F0000-0x000007FEF3368000-memory.dmp

    Filesize

    1.5MB

  • memory/2684-86-0x000007FEF31D0000-0x000007FEF31E7000-memory.dmp

    Filesize

    92KB

  • memory/2684-97-0x000000013F600000-0x000000013F6F8000-memory.dmp

    Filesize

    992KB

  • memory/2684-99-0x000007FEF6460000-0x000007FEF6714000-memory.dmp

    Filesize

    2.7MB

  • memory/2684-98-0x000007FEFB490000-0x000007FEFB4C4000-memory.dmp

    Filesize

    208KB

  • memory/2684-100-0x000007FEF4F30000-0x000007FEF5FDB000-memory.dmp

    Filesize

    16.7MB