DisposicionesGenerales-Mayo2019_2019-07-10_08_30.txt

* MalFamily: ""

* MalScore: 2.0

* File Name: "DisposicionesGenerales-Mayo2019"
* File Size: 5002
* File Type: "ASCII text, with very long lines, with no line terminators"
* SHA256: "0fbeecbded3a0415719319140c41bb83c216bc68621e7a8b63357f1538a61953"
* MD5: "4a27b628ab5bc1d54a2373e88b7967b8"
* SHA1: "11f1ac268c9457734e23f96621575f4c10f3b87d"
* SHA512: "02a7399a92f89043aeed18fe3fedfdfbe4e0a1acf79d0e455012e526f564e02f06eb1b6a694dbe4ecf9dd0b10e82636c08c5f8fc6d9b02cb6e59da09e8ef8420"
* CRC32: "6AB39C08"
* SSDEEP: "96:9knAL4krRi3ycX1Elv5fFOGAnLXGQPrz3TqCOT3NX3wvg23/3W3QNUNpgJqF3tV:9knAL4d3Elv585nrdXmJT9k/GAyNpggJ"

* Process Execution:
    "cmd.exe",
    "rundll32.exe",
    "services.exe",
    "svchost.exe"


* Executed Commands:
    "\"C:\\Windows\\system32\\rundll32.exe\" C:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL C:\\Users\\user\\AppData\\Local\\Temp\\DisposicionesGenerales-Mayo2019",
    "C:\\Users\\user\\AppData\\Local\\Temp\\DisposicionesGenerales-Mayo2019 ",
    "C:\\Windows\\system32\\svchost.exe -k netsvcs"


* Signatures Detected:

        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details":

                "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 3010377 times"





* Started Service:
    "AppMgmt"


* Mutexes:
    "Local\\ZoneAttributeCacheCounterMutex",
    "Local\\ZonesCacheCounterMutex",
    "Local\\ZonesLockedCacheCounterMutex"


* Modified Files:

* Deleted Files:

* Modified Registry Keys:
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\OpenWithList"


* Deleted Registry Keys:
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"


* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: