Overview
overview
10Static
static
10Apache_Ope...es.exe
windows10-ltsc 2021-x64
6$PLUGINSDI...ns.dll
windows10-ltsc 2021-x64
3stat.py
windows10-ltsc 2021-x64
3stats.py
windows10-ltsc 2021-x64
3statvfs.py
windows10-ltsc 2021-x64
3stl_01.ott
windows10-ltsc 2021-x64
3stl_02.ott
windows10-ltsc 2021-x64
3stl_03.ott
windows10-ltsc 2021-x64
3swui.dll
windows10-ltsc 2021-x64
3symbol.py
windows10-ltsc 2021-x64
3symbols.py
windows10-ltsc 2021-x64
3symtable.py
windows10-ltsc 2021-x64
3synchronize.py
windows10-ltsc 2021-x64
3syntax.py
windows10-ltsc 2021-x64
3sysconfig.py
windows10-ltsc 2021-x64
3sysconfig1.py
windows10-ltsc 2021-x64
3sysdtrans.dll
windows10-ltsc 2021-x64
3sysmail.uno.dll
windows10-ltsc 2021-x64
3syssh.uno.dll
windows10-ltsc 2021-x64
3t602filter.dll
windows10-ltsc 2021-x64
3tabbedpages.py
windows10-ltsc 2021-x64
3table.jar
windows10-ltsc 2021-x64
1tabnanny.py
windows10-ltsc 2021-x64
3tarfile.py
windows10-ltsc 2021-x64
3telnetlib.py
windows10-ltsc 2021-x64
3tempfile.py
windows10-ltsc 2021-x64
3textoutstream.uno.dll
windows10-ltsc 2021-x64
3openoffice4115.msi
windows10-ltsc 2021-x64
6readmes/re...s.html
windows10-ltsc 2021-x64
4redist/vcr...64.exe
windows10-ltsc 2021-x64
7redist/vcr...86.exe
windows10-ltsc 2021-x64
7setup.exe
windows10-ltsc 2021-x64
7Analysis
-
max time kernel
418s -
max time network
448s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-es -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows -
submitted
22/01/2025, 15:18
Behavioral task
behavioral1
Sample
Apache_OpenOffice_4.1.15_Win_x86_install_es.exe
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral3
Sample
stat.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral4
Sample
stats.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral5
Sample
statvfs.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral6
Sample
stl_01.ott
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral7
Sample
stl_02.ott
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral8
Sample
stl_03.ott
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral9
Sample
swui.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral10
Sample
symbol.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral11
Sample
symbols.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral12
Sample
symtable.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral13
Sample
synchronize.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral14
Sample
syntax.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral15
Sample
sysconfig.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral16
Sample
sysconfig1.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral17
Sample
sysdtrans.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral18
Sample
sysmail.uno.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral19
Sample
syssh.uno.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral20
Sample
t602filter.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral21
Sample
tabbedpages.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral22
Sample
table.jar
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral23
Sample
tabnanny.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral24
Sample
tarfile.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral25
Sample
telnetlib.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral26
Sample
tempfile.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral27
Sample
textoutstream.uno.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral28
Sample
openoffice4115.msi
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral29
Sample
readmes/readme_es.html
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral30
Sample
redist/vcredist_x64.exe
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral31
Sample
redist/vcredist_x86.exe
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral32
Sample
setup.exe
Resource
win10ltsc2021-20250113-es
General
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
15KB
-
MD5
d095b082b7c5ba4665d40d9c5042af6d
-
SHA1
2220277304af105ca6c56219f56f04e894b28d27
-
SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c
-
SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9
-
SSDEEP
192:EyGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTr11929WtshLAzgSrX8:EyNt+4t7uJalUnGesY7Lt8nCr/Yosa
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3268 2756 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 656 wrote to memory of 2756 656 rundll32.exe 82 PID 656 wrote to memory of 2756 656 rundll32.exe 82 PID 656 wrote to memory of 2756 656 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 6363⤵
- Program crash
PID:3268
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2756 -ip 27561⤵PID:4676