Analysis

  • max time kernel
    143s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18-07-2024 13:18

General

  • Target

    Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar

  • Size

    714KB

  • MD5

    325b88a0301801c9e04590d2514f6a8e

  • SHA1

    79203bbe463d36eb199c2b97732ba638b5764780

  • SHA256

    81f6ee45019c48d23ac3265a1ba120d0b34a74e7a51ae3d1c5cecea4db88fe8b

  • SHA512

    32163a4ff580ee3ed1f43ba1990e8688cedd5b44c93ca7de138d6fe69eaaacd6712a3c19c260f692ab964db7677f5d8d79c5171785a4fbd7d15e8d6621b69621

  • SSDEEP

    12288:lDYQqAva5eO/WQKTYqW/niHEofaPHKDb79xAvRIyWmipePX0xU571Or0X:l2nUO/WQeYqGnilfafKDLgIyWePX0C5n

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2608-29-0x000000013F6A0000-0x000000013F798000-memory.dmp

    Filesize

    992KB

  • memory/2608-30-0x000007FEFA890000-0x000007FEFA8C4000-memory.dmp

    Filesize

    208KB

  • memory/2608-32-0x000007FEF70E0000-0x000007FEF70F8000-memory.dmp

    Filesize

    96KB

  • memory/2608-38-0x000007FEF6560000-0x000007FEF6571000-memory.dmp

    Filesize

    68KB

  • memory/2608-37-0x000007FEF6580000-0x000007FEF659D000-memory.dmp

    Filesize

    116KB

  • memory/2608-36-0x000007FEF65A0000-0x000007FEF65B1000-memory.dmp

    Filesize

    68KB

  • memory/2608-35-0x000007FEF65C0000-0x000007FEF65D7000-memory.dmp

    Filesize

    92KB

  • memory/2608-34-0x000007FEF6B30000-0x000007FEF6B41000-memory.dmp

    Filesize

    68KB

  • memory/2608-33-0x000007FEF6B70000-0x000007FEF6B87000-memory.dmp

    Filesize

    92KB

  • memory/2608-31-0x000007FEF5A00000-0x000007FEF5CB6000-memory.dmp

    Filesize

    2.7MB

  • memory/2608-40-0x000007FEF57F0000-0x000007FEF59FB000-memory.dmp

    Filesize

    2.0MB

  • memory/2608-60-0x000007FEF5450000-0x000007FEF5462000-memory.dmp

    Filesize

    72KB

  • memory/2608-59-0x000007FEF5470000-0x000007FEF5481000-memory.dmp

    Filesize

    68KB

  • memory/2608-58-0x000007FEF5490000-0x000007FEF54B3000-memory.dmp

    Filesize

    140KB

  • memory/2608-57-0x000007FEF54C0000-0x000007FEF54D8000-memory.dmp

    Filesize

    96KB

  • memory/2608-56-0x000007FEF54E0000-0x000007FEF5504000-memory.dmp

    Filesize

    144KB

  • memory/2608-55-0x000007FEF5510000-0x000007FEF5538000-memory.dmp

    Filesize

    160KB

  • memory/2608-54-0x000007FEF5540000-0x000007FEF5597000-memory.dmp

    Filesize

    348KB

  • memory/2608-53-0x000007FEF55A0000-0x000007FEF55B1000-memory.dmp

    Filesize

    68KB

  • memory/2608-52-0x000007FEF55C0000-0x000007FEF563C000-memory.dmp

    Filesize

    496KB

  • memory/2608-51-0x000007FEF5640000-0x000007FEF56A7000-memory.dmp

    Filesize

    412KB

  • memory/2608-50-0x000007FEF56B0000-0x000007FEF56E0000-memory.dmp

    Filesize

    192KB

  • memory/2608-49-0x000007FEF56E0000-0x000007FEF56F8000-memory.dmp

    Filesize

    96KB

  • memory/2608-48-0x000007FEF5700000-0x000007FEF5711000-memory.dmp

    Filesize

    68KB

  • memory/2608-47-0x000007FEF5720000-0x000007FEF573B000-memory.dmp

    Filesize

    108KB

  • memory/2608-46-0x000007FEF5740000-0x000007FEF5751000-memory.dmp

    Filesize

    68KB

  • memory/2608-45-0x000007FEF5760000-0x000007FEF5771000-memory.dmp

    Filesize

    68KB

  • memory/2608-44-0x000007FEF5780000-0x000007FEF5791000-memory.dmp

    Filesize

    68KB

  • memory/2608-43-0x000007FEF60A0000-0x000007FEF60B8000-memory.dmp

    Filesize

    96KB

  • memory/2608-42-0x000007FEF6100000-0x000007FEF6121000-memory.dmp

    Filesize

    132KB

  • memory/2608-41-0x000007FEF57A0000-0x000007FEF57E1000-memory.dmp

    Filesize

    260KB

  • memory/2608-39-0x000007FEF4170000-0x000007FEF5220000-memory.dmp

    Filesize

    16.7MB