Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31-10-2024 15:16

General

  • Target

    VER PROCESO ADELANTADO EN SU CONTRA RD20017-70-71216-2024-00926-00.exe

  • Size

    1.2MB

  • MD5

    03f0ee8b8dea367a9103c169d10c583c

  • SHA1

    2015ad059d6726a328f073bf6b77f1dd8f0df1f0

  • SHA256

    5b8aa9408ee3d18a803df688974bfc125b110db19349e1938ac8d3bb6a966fcc

  • SHA512

    87f6d5386ab9f81894556f9315a0124b9db1366a21b85c418af727235a7c0f93f91f17cc3753425979e2b24b4958b33f62620b7ab803df6b60e811f6b61f2d6e

  • SSDEEP

    24576:6mGcXFh4xuKn47ipX4fai8Wh1vW1kuT4SKd0:66XFCxf80ofas1v8T450

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VER PROCESO ADELANTADO EN SU CONTRA RD20017-70-71216-2024-00926-00.exe
    "C:\Users\Admin\AppData\Local\Temp\VER PROCESO ADELANTADO EN SU CONTRA RD20017-70-71216-2024-00926-00.exe"
    1⤵
    • Drops startup file
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 656
      2⤵
      • Program crash
      PID:5804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2872-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

    Filesize

    4KB

  • memory/2872-1-0x00000000003D0000-0x0000000000508000-memory.dmp

    Filesize

    1.2MB

  • memory/2872-2-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2872-3-0x0000000004830000-0x000000000491C000-memory.dmp

    Filesize

    944KB

  • memory/2872-4-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-5-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-20-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-17-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-15-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-13-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-11-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-9-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-7-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-35-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-67-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-65-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-63-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-61-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-59-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-57-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-55-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-53-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-52-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-49-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-47-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-45-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-43-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-41-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-39-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-37-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-33-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-31-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-29-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-27-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-25-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-23-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-21-0x0000000004830000-0x0000000004917000-memory.dmp

    Filesize

    924KB

  • memory/2872-1078-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2872-1079-0x00000000022D0000-0x000000000232E000-memory.dmp

    Filesize

    376KB

  • memory/2872-1080-0x00000000023C0000-0x000000000240C000-memory.dmp

    Filesize

    304KB

  • memory/2872-1081-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

    Filesize

    4KB

  • memory/2872-1082-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2872-1083-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2872-1084-0x0000000002410000-0x0000000002464000-memory.dmp

    Filesize

    336KB

  • memory/2872-1087-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB