Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 06:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Factura comercial.pdf.exe
Resource
win7-20231129-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Factura comercial.pdf.exe
Resource
win10v2004-20240226-en
4 signatures
150 seconds
General
-
Target
Factura comercial.pdf.exe
-
Size
1.1MB
-
MD5
2a07051d44440cd3c25081da8e13937d
-
SHA1
cf8c01d5bf1208ab2f8806fef2cb735a53486e36
-
SHA256
af4c8dace0ca65db170c11477a3794af2ad3feb706bda810988a22ce72af5a68
-
SHA512
8862d95a3903c66bf0b71d36e4748d192e730301efef6092f86565d6eff543266799c5b571f62d985174e26e50f4da842e17bb3fc4269f238d71442c29f97b0c
-
SSDEEP
24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8aIvgpkO6qHAYDb:ETvC/MTQYxsWR7aIvgNVHTD
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2696 4832 WerFault.exe Factura comercial.pdf.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Factura comercial.pdf.exepid process 4832 Factura comercial.pdf.exe 4832 Factura comercial.pdf.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Factura comercial.pdf.exepid process 4832 Factura comercial.pdf.exe 4832 Factura comercial.pdf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Factura comercial.pdf.exedescription pid process target process PID 4832 wrote to memory of 392 4832 Factura comercial.pdf.exe RegSvcs.exe PID 4832 wrote to memory of 392 4832 Factura comercial.pdf.exe RegSvcs.exe PID 4832 wrote to memory of 392 4832 Factura comercial.pdf.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura comercial.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Factura comercial.pdf.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Factura comercial.pdf.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 6922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4832 -ip 48321⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4832-10-0x0000000000BB0000-0x0000000000BB4000-memory.dmpFilesize
16KB