Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nueva orden de compra.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
General
-
Target
Nueva orden de compra.exe
-
Size
7.1MB
-
MD5
9b2c361b77d2a5198602a24b473b506a
-
SHA1
01a4beda7991a7d5ad9717e25e3d47d219dec1f9
-
SHA256
9ebb6978d40e7e5870ee40d426ccc6cf7eff686b5d95375399c6d15388067f0d
-
SHA512
3fb44a807dc6bc1aaf97f7a39b06a870d1f8d19429cd699b1839ee4233d1267ab3fac535255b49d07d32937e79df888c1e75c52a725405b416ed99236465741e
-
SSDEEP
98304:YlaHVJHFOv9GJ6RiiOPriSL+pMI6cNKu4X2XfQ9rr6YrxV:ZHzFOvcOS0MRcNz4mI9qYtV
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5448 2096 WerFault.exe Nueva orden de compra.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Nueva orden de compra.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nueva orden de compra.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Nueva orden de compra.exepid process 2096 Nueva orden de compra.exe 2096 Nueva orden de compra.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Nueva orden de compra.exedescription pid process Token: SeDebugPrivilege 2096 Nueva orden de compra.exe Token: SeDebugPrivilege 2096 Nueva orden de compra.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Nueva orden de compra.exedescription pid process target process PID 2096 wrote to memory of 5448 2096 Nueva orden de compra.exe WerFault.exe PID 2096 wrote to memory of 5448 2096 Nueva orden de compra.exe WerFault.exe PID 2096 wrote to memory of 5448 2096 Nueva orden de compra.exe WerFault.exe PID 2096 wrote to memory of 5448 2096 Nueva orden de compra.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nueva orden de compra.exe"C:\Users\Admin\AppData\Local\Temp\Nueva orden de compra.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 8642⤵
- Program crash
PID:5448
-