Overview
overview
10Static
static
702-CITACIO...TO.zip
windows7-x64
102-CITACIO...TO.zip
windows10-2004-x64
102-CITACIO...DA.exe
windows7-x64
1002-CITACIO...DA.exe
windows10-2004-x64
1002-CITACIO...up.exe
windows7-x64
702-CITACIO...up.exe
windows10-2004-x64
8out.exe
windows7-x64
out.exe
windows10-2004-x64
02-CITACIO...et.eps
windows7-x64
302-CITACIO...et.eps
windows10-2004-x64
302-CITACIO....accdb
windows7-x64
302-CITACIO....accdb
windows10-2004-x64
302-CITACIO...c_.dll
windows7-x64
302-CITACIO...c_.dll
windows10-2004-x64
302-CITACIO...m_.dll
windows7-x64
302-CITACIO...m_.dll
windows10-2004-x64
302-CITACIO...t_.dll
windows7-x64
302-CITACIO...t_.dll
windows10-2004-x64
302-CITACIO...20.dll
windows7-x64
302-CITACIO...20.dll
windows10-2004-x64
302-CITACIO...20.dll
windows7-x64
302-CITACIO...20.dll
windows10-2004-x64
302-CITACIO...20.dll
windows7-x64
302-CITACIO...20.dll
windows10-2004-x64
3Analysis
-
max time kernel
135s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 17:19
Behavioral task
behavioral1
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO.zip
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/02 CITACION DEMANDA.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/02 CITACION DEMANDA.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/OperaSetup.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/OperaSetup.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
out.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
out.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/aigret.eps
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/aigret.eps
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/barrette.accdb
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/barrette.accdb
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/madbasic_.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/madbasic_.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/maddisAsm_.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/maddisAsm_.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/madexcept_.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/madexcept_.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/rtl120.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/rtl120.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/vcl120.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/vcl120.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/vclx120.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/vclx120.dll
Resource
win10v2004-20240709-en
General
-
Target
02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO/barrette.accdb
-
Size
17KB
-
MD5
3de728173727b206fe14724ba05a28c2
-
SHA1
407ca05387c9fc1ac22cd409df1f0899d49a7cde
-
SHA256
f923b85549cf4d2f87c11f4cdeb5abb408974aea8235aa68acc849736ebdde28
-
SHA512
33b6e43f6bdaf31b7387ffa683e9581afb4d9b170767e6c6a51180608568db9675fb16643ff462dfd53c6ca76789902553d9bb6e834734fbd8ce4f8726b76206
-
SSDEEP
384:moEH9+fB4OMKekS2JF9v3nd9wS+MdogIKR9ZEvUGDcMdMzGjVP:DEH9KfMKQWzv3dJPogIKR9iUWc/ajVP
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSACCESS.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2976 MSACCESS.EXE 2976 MSACCESS.EXE 2976 MSACCESS.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE"C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE" /NOSTARTUP "C:\Users\Admin\AppData\Local\Temp\02-CITACION DEMANADA-JUZGADO 01 PROMISCUO DEL CIRCUITO\barrette.accdb"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2976