Analysis
-
max time kernel
0s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07-12-2023 16:48
Static task
static1
Behavioral task
behavioral1
Sample
orden de compra.xla.xls
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
orden de compra.xla.xls
Resource
win10v2004-20231130-en
General
-
Target
orden de compra.xla.xls
-
Size
391KB
-
MD5
060f999d180fb2c37059815ebd76e38e
-
SHA1
605c01289d5b683a3d5b5eb17ebef72bfc388f91
-
SHA256
ac07988ba9649741c59d16698f8c33295b3ff7943eeccbafe6f988e3e3c10908
-
SHA512
a4449aa855a6426106516bf11499902f402ed4589fa7f11e628fec9efbcd6b8a6fcabdfb02d2fe3bf20a41889c734538e77194a011112b4dc06ae94e6b9c066e
-
SSDEEP
6144:Vn1m9kdbXgb8y3ZetJs0hdMJUXTdU5u/LbquQFBql4yUhNttSMS6EgU0rh:VOesblwtqSdLTdoaNQO6hQX+h
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.siscop.com.co - Port:
21 - Username:
[email protected] - Password:
+5s48Ia2&-(t
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Downloads MZ/PE file
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
pid Process 1596 EQNEDT32.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\orden de compra.xla.xls"1⤵
- Modifies Internet Explorer settings
PID:1220
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding1⤵PID:2292
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1664
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Launches Equation Editor
PID:1596 -
C:\Users\Admin\AppData\Roaming\wlanext.exe"C:\Users\Admin\AppData\Roaming\wlanext.exe"2⤵PID:328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{87AAB88C-56AF-47B6-B075-77A26D485B50}.FSD
Filesize128KB
MD574d8625bbf8e1419e9139b7b67da555a
SHA1e5a354755f0ce842ec90d21f1d91d3d27729427d
SHA256bb00585d96d183cdc89d1478bff3edd9e1e9976fffa2f3eb086624e7f312bd7c
SHA512c00451063f236ed08c90c9e7640b61552762b4c283e6acfc18c5002149ff8b731d1b473decb714f3c4adf1ef5ab2c7cffb472c2d2ad4f4c09712d3b16d5f4605
-
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
Filesize128KB
MD56378fbe953dc3896bfaf440d4178d04b
SHA11e881567147bb32dd0697debed01825d8faa9dfd
SHA2566344f943a947cc86726e50c83e325a3791616d59e49dbec054a76d1e33d4d2df
SHA5122504e9e8f17c6124cd075005f38a273239594e840871c21dbd660b937dca9b2fbbd2c7080d434ef12ace6f57761934b82bc6696e9fdcd3f2e2966c512317e895
-
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
Filesize128KB
MD570c213303b48371bf0fc242c4288610d
SHA164207a00777c26325e1de3f93dda5e90988f77a2
SHA25681d6880fe493385a5a80e7f5c90d50c48e4e58b7e45b1f1f1a83b18ef5d1a456
SHA512399ab1a86c667a20e16901e2b8c245ecce9cd3de9ccdfec4443c33a0c9479e4b03d74568cc5307bd2745f51323681bfc030fb4f957e610a4ca28c14611d094cb
-
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{2B2B30E7-1D10-466E-BD34-8AFEE2B9DACF}.FSD
Filesize128KB
MD5101db6e15b7212f900fab9d98707ac01
SHA137886c2cfe9d84d02a4ac482784344a4fa13db17
SHA25640e1bce8318ec2b20e0e42695e37fde96b9f099b94b01832982c890a58e99f60
SHA5129fb5b518e49160ef840b905d21547eb9c70253dabd9dfc322a2b23e88f6f4d6fdbe8622dc179415c9253543693a27d23bdc8f9be190ab5c642eea3a4ab1d064c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HZPADLGW\microsoftunderstandwhyneedtodeleteentirehistorycachecookieverything[1].doc
Filesize59KB
MD5ed5d8e3f7b96288d349f167b737b0e32
SHA1d855f8bac1e28f42abe38db048e8839615db1be4
SHA256f118d7b310e09917603c15c5e6199f0bc04848ff9b3042b04fc8a94720a55d44
SHA5124b7a378ef8c805342b993129911f020b8a81eaada910329cedab1755177098a46d7c0bdea84451c8fb5801e5a998a8786a0ef57576edca169f55373ff0960037
-
Filesize
59KB
MD5ed5d8e3f7b96288d349f167b737b0e32
SHA1d855f8bac1e28f42abe38db048e8839615db1be4
SHA256f118d7b310e09917603c15c5e6199f0bc04848ff9b3042b04fc8a94720a55d44
SHA5124b7a378ef8c805342b993129911f020b8a81eaada910329cedab1755177098a46d7c0bdea84451c8fb5801e5a998a8786a0ef57576edca169f55373ff0960037
-
Filesize
128KB
MD51dd95424f685720280bd503728c52521
SHA1fabdb6e19e40868fb9981ca7d42e86c0503bd6ee
SHA2566dffc8714888ab0c69fdeb9d4359a683b17e66bbf775513fa9f64ac234ba50e0
SHA512dfd85be0dfe07514f12af36b97136d2727229c52d23c2769bcc3ae23dcf9b4ff517f313d32f160b5e7bad3e0092cbf409807139867b1a683d994d253e340db54
-
Filesize
20KB
MD51ea99b26b3ffc464c52043c084aa34e0
SHA1d18be6b04ceb2dea931a67d5e05da400f7ce1c99
SHA25690467efe408ee89720b341dddc2f1db4823185ae6468b398a1c30088962e560d
SHA512777ed60e7b8bc97e849ef7a212dbc80bbdc3fbd867aab68285527ac8ff6ca5cb272711f80b5db36b90f5d31874208b6ccb986cb1257e4c096abb28c788c63502
-
Filesize
666KB
MD5e81d3a6286beea59a2fe264b2b4ee156
SHA1acbff15ea6b56cb04810e826bfb555b5c2b7efae
SHA256808dc37ef54a4c95bb66f4773d8a84d9b6f548b00bae26ee514996a7f46d2a04
SHA5125239f0f66a3d2b2855d104ebd2e4f3f30766a7fb04f1fc4c6d93139f43ee3e8befd6fd2043d1bcd5a3860af96f0527fb7e784162fbc32367fcb27da80db27d6b
-
Filesize
666KB
MD5e81d3a6286beea59a2fe264b2b4ee156
SHA1acbff15ea6b56cb04810e826bfb555b5c2b7efae
SHA256808dc37ef54a4c95bb66f4773d8a84d9b6f548b00bae26ee514996a7f46d2a04
SHA5125239f0f66a3d2b2855d104ebd2e4f3f30766a7fb04f1fc4c6d93139f43ee3e8befd6fd2043d1bcd5a3860af96f0527fb7e784162fbc32367fcb27da80db27d6b
-
Filesize
666KB
MD5e81d3a6286beea59a2fe264b2b4ee156
SHA1acbff15ea6b56cb04810e826bfb555b5c2b7efae
SHA256808dc37ef54a4c95bb66f4773d8a84d9b6f548b00bae26ee514996a7f46d2a04
SHA5125239f0f66a3d2b2855d104ebd2e4f3f30766a7fb04f1fc4c6d93139f43ee3e8befd6fd2043d1bcd5a3860af96f0527fb7e784162fbc32367fcb27da80db27d6b
-
Filesize
666KB
MD5e81d3a6286beea59a2fe264b2b4ee156
SHA1acbff15ea6b56cb04810e826bfb555b5c2b7efae
SHA256808dc37ef54a4c95bb66f4773d8a84d9b6f548b00bae26ee514996a7f46d2a04
SHA5125239f0f66a3d2b2855d104ebd2e4f3f30766a7fb04f1fc4c6d93139f43ee3e8befd6fd2043d1bcd5a3860af96f0527fb7e784162fbc32367fcb27da80db27d6b