Analysis
-
max time kernel
79s -
max time network
81s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19-07-2024 23:51
Static task
static1
Behavioral task
behavioral1
Sample
Solicitud-00002320012454100.rar
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
Solicitud-00002320012454100.rar
-
Size
1.5MB
-
MD5
e3546c9971b02f17644002a43903694f
-
SHA1
eb0ad8f09bd4792c90a24b838f775857dfdeef20
-
SHA256
c42ca7e0ce3957b35e9cf2446ebcb7d008e3ceb362d6a6fc16377b7710c16514
-
SHA512
48a80b89622214cb3fbfa5b7250291105132f33d4a7a919a8e1c17d81e34d01bd3d0a17a7f1c95123f07ad394207477428d473ce2126b445874c072fe26a7d21
-
SSDEEP
49152:ng5Vj8jCnF+V2NBdoCIv+QanpGMDCjjFQM:Ej8jCF+V4oCCSnQMDCnFd
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1288 OpenWith.exe -
Suspicious use of SetWindowsHookEx 57 IoCs
pid Process 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1288 OpenWith.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1688 1288 OpenWith.exe 75 PID 1288 wrote to memory of 1688 1288 OpenWith.exe 75 PID 1288 wrote to memory of 1688 1288 OpenWith.exe 75 PID 1688 wrote to memory of 3364 1688 AcroRd32.exe 78 PID 1688 wrote to memory of 3364 1688 AcroRd32.exe 78 PID 1688 wrote to memory of 3364 1688 AcroRd32.exe 78 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 1456 3364 RdrCEF.exe 79 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80 PID 3364 wrote to memory of 3488 3364 RdrCEF.exe 80
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Solicitud-00002320012454100.rar1⤵
- Modifies registry class
PID:3328
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud-00002320012454100.rar"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8C75EE4183140EF64148E41C3506B7B1 --mojo-platform-channel-handle=1608 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:1456
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8C0879052124D6A1A5BB16F7805D4915 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8C0879052124D6A1A5BB16F7805D4915 --renderer-client-id=2 --mojo-platform-channel-handle=1644 --allow-no-sandbox-job /prefetch:14⤵PID:3488
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=76D06D85D14A7295A17F418D001C3078 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:4552
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CFE3651605E60EC88F66336DE9A3E711 --mojo-platform-channel-handle=2404 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2888
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=12D8C5BC005781214972FE5ED5A7A5C8 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:592
-
-
-