Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06-12-2024 15:13
General
-
Target
DEMANDA LABORAL POR ABUSO DE CONFIANZA 01.7z
-
Size
4.8MB
-
MD5
87aa9b12c1b0c3e870690b9439b839d6
-
SHA1
74aa95746c8b1c2fa9463b0a549feea78b112d11
-
SHA256
a53ec05a1c33d2d78afa7e0b7385a8e60388d19110ba1cf72afa99d295bad315
-
SHA512
a5bed4661483d10e8521e9b26b3dbf628e560102c1ca93c239016d0c11e4c87c92cc4b7dfbc7773456be01e1795714009b1b4b6dad245e83196025d41c69f267
-
SSDEEP
98304:xWI7FJcIkR6IQVD9ROh6kAAgTsT3ZwwZ1/Yre2HX3EA1lwRhIXVomHyILbav:wUyR6IoDPejArTe3ZNwp3EqamdL0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 13 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\DEMANDA LABORAL POR ABUSO DE CONFIANZA 01.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\DEMANDA LABORAL POR ABUSO DE CONFIANZA 01\01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe"C:\Users\Admin\Desktop\DEMANDA LABORAL POR ABUSO DE CONFIANZA 01\01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "l1TC0x" /tr "C:\Users\Admin\AppData\Roaming\01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe" /sc onlogon /rl highest /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "l1TC0x" /tr "C:\Users\Admin\AppData\Roaming\01 DEMANDA LABORAL POR ABUSO DE CONFIANZA.exe" /sc onlogon /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481KB
MD5a30283c01840f1a26afe40ae0b576bf8
SHA1f4568fda687c1720b80ff07a12b38f8d1d6af33c
SHA256e2a4a7e147898dc2d01f1b4d2892000395f5e43770a25ecdb170bb185ac0477a
SHA5128fc5de3c634032f57cebf8f7967ecca0952a37e5c949f34cc208f7734a6162e8276699de1b4501ba196170468b4ef472002db09dc3fcee072e66ff3477a24c54
-
Filesize
2.6MB
MD5e2e01305e938ea378a88658d81c0917f
SHA16b3dc7e13347f6fadadc2dbac7d3a3927d9e2aa6
SHA25629c3c48f4dc84e7179881bc3767546878b2db89d418372f687edbd4a72ef0989
SHA5125620ea58d2a7da0fe5d352ea1fe82e76ed84c31b2ae97b28a3ab3b25268f21c0a8eef8ca7baa05ab0f2c80a8125fc7e2441065eda11259b1f636be7b3d6c202d
-
Filesize
6.9MB
MD56d4e5e67defde30eb1e41f7daef2e35f
SHA1c840c5e2299b119a86f59c152dd804c32cdf38f2
SHA256fe8b684b17b074d43782c9419f8739c0179c34e095a02c30e4519face3a51489
SHA5126b1bdc2dd5323ae1bfccda5ec98eab55596df097df985fc0afa9236d86a966ee8e1c7f76abe2fe17b8e8c63c628da5143490d2d0b6a7bb49a4408a2e482b9616
-
Filesize
121KB
MD59c521a90653df5d1efbd0cea12318863
SHA1ec2afaf10b78dabfead9e9e485d454789c244188
SHA25685bcfc9de06bd0751245ad882f7e2141f340cdedefcaefb8deabbc0792088a58
SHA512d1bbb5e07e7df5fe6da9786ecee06c0dfd9e46067de48a139323aa045f81139b78404c4f3f77b1f6f58c3b11d1edf88d0c06ad42fcf7482436367f2444e6152e
-
Filesize
6.1MB
-
Filesize
6.9MB