Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-01-2025 15:57
Static task
static1
Behavioral task
behavioral1
Sample
01-ACTUACION JUDICIAL EN SU CONTRA.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
01-ACTUACION JUDICIAL EN SU CONTRA.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
7z2409-x64.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
7z2409-x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
CiscoSparkLauncher.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
CiscoSparkLauncher.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
VERSION.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
VERSION.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
General
-
Target
CiscoSparkLauncher.dll
-
Size
2.6MB
-
MD5
e2e01305e938ea378a88658d81c0917f
-
SHA1
6b3dc7e13347f6fadadc2dbac7d3a3927d9e2aa6
-
SHA256
29c3c48f4dc84e7179881bc3767546878b2db89d418372f687edbd4a72ef0989
-
SHA512
5620ea58d2a7da0fe5d352ea1fe82e76ed84c31b2ae97b28a3ab3b25268f21c0a8eef8ca7baa05ab0f2c80a8125fc7e2441065eda11259b1f636be7b3d6c202d
-
SSDEEP
49152:aGtlqOIU6iJVwASOcO81WPz3qjFr6t1Dt+w+PpmtsHcFhKgwzfQHdPWkpRs6:m+18rcDINHAhKQH8S
Malware Config
Signatures
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2060 wmic.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2060 wmic.exe Token: SeSecurityPrivilege 2060 wmic.exe Token: SeTakeOwnershipPrivilege 2060 wmic.exe Token: SeLoadDriverPrivilege 2060 wmic.exe Token: SeSystemProfilePrivilege 2060 wmic.exe Token: SeSystemtimePrivilege 2060 wmic.exe Token: SeProfSingleProcessPrivilege 2060 wmic.exe Token: SeIncBasePriorityPrivilege 2060 wmic.exe Token: SeCreatePagefilePrivilege 2060 wmic.exe Token: SeBackupPrivilege 2060 wmic.exe Token: SeRestorePrivilege 2060 wmic.exe Token: SeShutdownPrivilege 2060 wmic.exe Token: SeDebugPrivilege 2060 wmic.exe Token: SeSystemEnvironmentPrivilege 2060 wmic.exe Token: SeRemoteShutdownPrivilege 2060 wmic.exe Token: SeUndockPrivilege 2060 wmic.exe Token: SeManageVolumePrivilege 2060 wmic.exe Token: 33 2060 wmic.exe Token: 34 2060 wmic.exe Token: 35 2060 wmic.exe Token: SeIncreaseQuotaPrivilege 2060 wmic.exe Token: SeSecurityPrivilege 2060 wmic.exe Token: SeTakeOwnershipPrivilege 2060 wmic.exe Token: SeLoadDriverPrivilege 2060 wmic.exe Token: SeSystemProfilePrivilege 2060 wmic.exe Token: SeSystemtimePrivilege 2060 wmic.exe Token: SeProfSingleProcessPrivilege 2060 wmic.exe Token: SeIncBasePriorityPrivilege 2060 wmic.exe Token: SeCreatePagefilePrivilege 2060 wmic.exe Token: SeBackupPrivilege 2060 wmic.exe Token: SeRestorePrivilege 2060 wmic.exe Token: SeShutdownPrivilege 2060 wmic.exe Token: SeDebugPrivilege 2060 wmic.exe Token: SeSystemEnvironmentPrivilege 2060 wmic.exe Token: SeRemoteShutdownPrivilege 2060 wmic.exe Token: SeUndockPrivilege 2060 wmic.exe Token: SeManageVolumePrivilege 2060 wmic.exe Token: 33 2060 wmic.exe Token: 34 2060 wmic.exe Token: 35 2060 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2060 1932 rundll32.exe 30 PID 1932 wrote to memory of 2060 1932 rundll32.exe 30 PID 1932 wrote to memory of 2060 1932 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\CiscoSparkLauncher.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2060
-