bd25554c274a03203a99a4bc55c6a8553edbcc7dbee5ec606eefbedd7f551e00

Resubmissions

30-05-2024 18:53

240530-xjnklagb6z 10

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.7z
Size

6.7MB
MD5

e7f702dc462b1412f249ec88ef2fe805
SHA1

6f2bfea9cc30ce7b39d2a3c41f4964ed6271936b
SHA256

bd25554c274a03203a99a4bc55c6a8553edbcc7dbee5ec606eefbedd7f551e00
SHA512

e31375cc4c1e473c6a464df4ac03aa48f1699035d486cec8df6e363fc569724b8bfae792cf32aeb57b5f70d5cd95f8eae0ea162837b1d16d183c064b68e6a3d6
SSDEEP

98304:amQ3hjPu8RvZwCB9Y5h4LILfFBnk60LVqZAMpWB28gOsTW6bJo02GVAWgKeuYNbi:amaj2s5s5hlk60LMAMpSfkXbuG5ezBf6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

rundll32.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2976 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2976 AcroRd32.exe
2976 AcroRd32.exe

pid	process
2976	AcroRd32.exe

pid	process
2976	AcroRd32.exe
2976	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1644 wrote to memory of 2668	1644	cmd.exe	rundll32.exe
PID 1644 wrote to memory of 2668	1644	cmd.exe	rundll32.exe
PID 1644 wrote to memory of 2668	1644	cmd.exe	rundll32.exe
PID 2668 wrote to memory of 2560	2668	rundll32.exe	rundll32.exe
PID 2668 wrote to memory of 2560	2668	rundll32.exe	rundll32.exe
PID 2668 wrote to memory of 2560	2668	rundll32.exe	rundll32.exe
PID 2560 wrote to memory of 2976	2560	rundll32.exe	AcroRd32.exe
PID 2560 wrote to memory of 2976	2560	rundll32.exe	AcroRd32.exe
PID 2560 wrote to memory of 2976	2560	rundll32.exe	AcroRd32.exe
PID 2560 wrote to memory of 2976	2560	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.7z"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.7z
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.7z
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\03- PROCESO JUDICIAL JUZGADO CIVIL 02 DEL CIRCUITO.7z"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1a5a8f0d9fe25051243a6eb71f68949c

SHA1
6e9678ee5634f4da7463f742c84d7ce972438333

SHA256
72db09bfccd74270f264dc209822b257ffc291634ba5c542d888a28873257e2b

SHA512
a759afc174a4cb052bb12caff2f27c412ac3b024405e4d6a985269f73a3d3345ae8dad39c67af414aa29308f44b7b2cdaa6a9d87c2a27019cd6f2b921682590f

Download Submit