Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231129-es -
resource tags
-
submitted
09/01/2024, 21:54
General
-
Target
Recib PDF IGZCOSEFTATT.exe
-
Size
124.9MB
-
MD5
a9a520c6fa401186dcfb12aff7142c72
-
SHA1
5be2ab81e761035c03a433d0c7dab1dc53734b5d
-
SHA256
08d63634e0c00db5ccd27e1313fe6fa059c7190ea273f37c55e74ee765b26674
-
SHA512
34355f64878fdf8ffe4bb8d86d1f273cdf2f136f5bdfb4501dade8fb5ca0a1a0dcabb643d4d73568340d3393cf744c995fad8411f87a78ce1811b1d4b09ed1a8
-
SSDEEP
98304:3JPv3GsOXnoX51xw0x9eqxOCyaPf6d3VCRXHIglFpFxA0ROkYQfynjAK:3ROXopROCyaPU+XoglV7ROkYQf
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Recib PDF IGZCOSEFTATT.exe"C:\Users\Admin\AppData\Local\Temp\Recib PDF IGZCOSEFTATT.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB