32f80f04d936215e00017d445f93489ddedb001a346c9ca04cdbbbd76c96b154

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pack de Optimizacion by bask1ngg/13. mantencion de disco/mantenimiento de disco/Desfragmentar y opti.lnk
Size

1KB
MD5

7781f1b5f68bdd1dedc1d5df67f89620
SHA1

d54cc9c554b4167153cb5125683c4765b9fad888
SHA256

cec00f754781ecd6eca60df9bebc66988ee294e19ba024a0a594ddecbc67a3bc
SHA512

4a3e3e03daf5e3a82f00e95e5f79518096702c424d1086274379152de87133742535739dfc8c2d7842008f421fc6e7d844a113ff1cbf314e0240302fb179d7de

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dfrgui.exe

pid process

2732 dfrgui.exe

pid	process
2732	dfrgui.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2180 wrote to memory of 2732	2180	cmd.exe	dfrgui.exe
PID 2180 wrote to memory of 2732	2180	cmd.exe	dfrgui.exe
PID 2180 wrote to memory of 2732	2180	cmd.exe	dfrgui.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Pack de Optimizacion by bask1ngg\13. mantencion de disco\mantenimiento de disco\Desfragmentar y opti.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\system32\dfrgui.exe
"C:\Windows\system32\dfrgui.exe"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2732

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-33-0x00000000022C0000-0x00000000023C0000-memory.dmp

Filesize
1024KB

Download
memory/2180-35-0x00000000022C0000-0x00000000023C0000-memory.dmp

Filesize
1024KB

Download
memory/2180-34-0x00000000022C0000-0x00000000023C0000-memory.dmp

Filesize
1024KB

Download
memory/2180-32-0x00000000022C0000-0x00000000023C0000-memory.dmp

Filesize
1024KB

Download
memory/2180-31-0x00000000022C0000-0x00000000023C0000-memory.dmp

Filesize
1024KB

Download