13639cd4d36be79a9f7df29a82e3c70893fcefea19be10988b990430d27a9c74

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Confirmacin de cuenta.pdf.exe
Size

1.0MB
MD5

314f72c3dfcb5075b2311ff757a79e94
SHA1

7b9db33098e5a14ca958224bb68ccc7ed6449727
SHA256

22858e8bcefe8c6d4099ee3a798758815b8f398c7c19c0be6156abec597c49a3
SHA512

60d93f9c471797c608ca55d1d992efe43962fbe341786bb67aac856f1716c0249eec7c416542a2cc565ea967591bb012e7e16b510c1b333bfa360df883432ad4
SSDEEP

24576:i4lavt0LkLL9IMixoEgeazDWU6UNq9MmCS:Vkwkn9IMHeazdaPCS

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	4436	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Confirmacin de cuenta.pdf.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4436	Confirmacin de cuenta.pdf.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4436	Confirmacin de cuenta.pdf.exe
4436	Confirmacin de cuenta.pdf.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4436	Confirmacin de cuenta.pdf.exe
4436	Confirmacin de cuenta.pdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 3500	4436	Confirmacin de cuenta.pdf.exe	86
PID 4436 wrote to memory of 3500	4436	Confirmacin de cuenta.pdf.exe	86
PID 4436 wrote to memory of 3500	4436	Confirmacin de cuenta.pdf.exe	86

C:\Users\Admin\AppData\Local\Temp\Confirmacin de cuenta.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Confirmacin de cuenta.pdf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\Confirmacin de cuenta.pdf.exe"
  2⤵
  PID:3500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 804
  2⤵
  - Program crash
  PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4436 -ip 4436
1⤵
PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4436-6-0x00000000010E0000-0x00000000014E0000-memory.dmp

Filesize
4.0MB

Download