GeneralesDisposiciones_2019-07-10_19_30.txt

* MalFamily: ""

* MalScore: 4.5

* File Name: "GeneralesDisposiciones"
* File Size: 299759
* File Type: "ASCII text, with very long lines, with CRLF line terminators"
* SHA256: "79aa3752e165803728cfe437988ce2222acbd8dfc600942e500aa10d0ebd805b"
* MD5: "4bae1c1898a8b10798b1e8c5ce4d75c0"
* SHA1: "ea265d2980c07e34327f9a359d895e1220b7cf56"
* SHA512: "ce41d259e64d57babd478479254f446a5ab2faf044dc33bb8d6149ce97cee1797ba4702b78600e20c5e7c1046d4f87f80bb79bc345c18dd5a88bcf2c4c98ecdf"
* CRC32: "DAEFD80C"
* SSDEEP: "1536:7TsMBV0N2nvJXKReO1CSX0g6njEWqWd8OUHaSrFksinbIidmNuvXV+/YIk2opXId:RLY"

* Process Execution:
    "cmd.exe",
    "rundll32.exe",
    "services.exe",
    "svchost.exe",
    "taskhost.exe",
    "svchost.exe",
    "WerFault.exe",
    "wermgr.exe"


* Executed Commands:
    "\"C:\\Windows\\system32\\rundll32.exe\" C:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL C:\\Users\\user\\AppData\\Local\\Temp\\GeneralesDisposiciones",
    "C:\\Users\\user\\AppData\\Local\\Temp\\GeneralesDisposiciones ",
    "C:\\Windows\\system32\\svchost.exe -k netsvcs",
    "taskhost.exe $(Arg0)",
    "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
    "C:\\Windows\\system32\\WerFault.exe -u -p 2604 -s 288",
    "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0b245809\""


* Signatures Detected:

        "Description": "At least one process apparently crashed during execution",
        "Details":


        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details":

                "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 6913460 times"




        "Description": "Checks the system manufacturer, likely for anti-virtualization",
        "Details":



* Started Service:
    "AppMgmt",
    "WerSvc"


* Mutexes:
    "Local\\ZoneAttributeCacheCounterMutex",
    "Local\\ZonesCacheCounterMutex",
    "Local\\ZonesLockedCacheCounterMutex",
    "Local\\WERReportingForProcess2604",
    "Global\\\\xe5\\x88\\x90\\xc2\\x86",
    "Global\\\\xe1\\x9f\\xa0(",
    "WERUI_BEX64-e0bfc78dc22baf57413d9e3a2494cb68424d695b"


* Modified Files:
    "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
    "C:\\Windows\\sysnative\\LogFiles\\Scm\\306de47d-f02c-4a28-a9ab-e8e97a3511b1",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA904.tmp.appcompat.txt",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCB33.tmp.WERInternalMetadata.xml",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCB53.tmp.hdmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERDA39.tmp.mdmp",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0b245809\\WERA904.tmp.appcompat.txt",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0b245809\\WERCB33.tmp.WERInternalMetadata.xml",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0b245809\\WERCB53.tmp.hdmp",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0b245809\\WERDA39.tmp.mdmp",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0b245809\\Report.wer",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0b245809\\Report.wer.tmp"


* Deleted Files:
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA904.tmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA904.tmp.appcompat.txt",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCB33.tmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCB33.tmp.WERInternalMetadata.xml",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCB53.tmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCB53.tmp.hdmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERDA39.tmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERDA39.tmp.mdmp",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0b245809\\Report.wer.tmp"


* Modified Registry Keys:
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent"


* Deleted Registry Keys:
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"


* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: