Analysis

  • max time kernel
    56s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-12-2024 17:28

General

  • Target

    Nueva carpeta.rar

  • Size

    283.5MB

  • MD5

    9c2ead201a1337bed740e5a7dd688039

  • SHA1

    65a69bbf98216d141287903359ee606d3867d8f6

  • SHA256

    ab78cc9b59a6e911f8e0fb608e1b22af481b44a49c765ecd68c4eddd576eb424

  • SHA512

    4f1f386335fbf96d5272db224eb2367df4d93f5edc76f9e82b70b297cc4645e3cbf235a3e2d652bd404b5e1984ee7e0a1d7e6cff6e971755eb1983ce69ce7ce0

  • SSDEEP

    6291456:3filrknPM1k8M45ydxCNqlj8q3lNBykkRm0yP8Skm1:3LPzTd0clXd78M

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 55 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Nueva carpeta.rar"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2664
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4912
    • C:\Users\Admin\Desktop\Nueva carpeta\Oxyco_Android_Pro_v3_Cracked.exe
      "C:\Users\Admin\Desktop\Nueva carpeta\Oxyco_Android_Pro_v3_Cracked.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3564
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 812
        2⤵
        • Program crash
        PID:2848
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3564 -ip 3564
      1⤵
        PID:5088
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /0
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:244
      • C:\Users\Admin\Desktop\Nueva carpeta\Oxyco_Android_Pro_v3_Cracked.exe
        "C:\Users\Admin\Desktop\Nueva carpeta\Oxyco_Android_Pro_v3_Cracked.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:820
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 784
          2⤵
          • Program crash
          PID:3828
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 820 -ip 820
        1⤵
          PID:1972

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/244-434-0x0000025846700000-0x0000025846701000-memory.dmp

          Filesize

          4KB

        • memory/244-436-0x0000025846700000-0x0000025846701000-memory.dmp

          Filesize

          4KB

        • memory/244-435-0x0000025846700000-0x0000025846701000-memory.dmp

          Filesize

          4KB

        • memory/244-440-0x0000025846700000-0x0000025846701000-memory.dmp

          Filesize

          4KB

        • memory/244-446-0x0000025846700000-0x0000025846701000-memory.dmp

          Filesize

          4KB

        • memory/244-445-0x0000025846700000-0x0000025846701000-memory.dmp

          Filesize

          4KB

        • memory/244-444-0x0000025846700000-0x0000025846701000-memory.dmp

          Filesize

          4KB

        • memory/244-443-0x0000025846700000-0x0000025846701000-memory.dmp

          Filesize

          4KB

        • memory/244-442-0x0000025846700000-0x0000025846701000-memory.dmp

          Filesize

          4KB

        • memory/244-441-0x0000025846700000-0x0000025846701000-memory.dmp

          Filesize

          4KB

        • memory/3564-432-0x00000000746AE000-0x00000000746AF000-memory.dmp

          Filesize

          4KB

        • memory/3564-433-0x0000000000350000-0x0000000001350000-memory.dmp

          Filesize

          16.0MB