Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-02-2024 20:00

General

  • Target

    informe bancario y motivo del pago rechazado.xls

  • Size

    30KB

  • MD5

    40e068be98ea0b6ca31af370328840b6

  • SHA1

    11e7096e6268536aa7e80e6f87c0c7815b067566

  • SHA256

    d7ae9c118c01c6751d64e011c70f601a73cb566df9ab3d43d25e69e30a5d8e4a

  • SHA512

    d7f114e8a91535e98a2ff1c492879ccb9b4979e9cfcfaab612cc80bb88c80f55f15bbc0dfc080175f509dd282c43712b60990dd1eed9cac84d0c4e5283f5a8a9

  • SSDEEP

    768:grYJUWXzyicoPdTeSGoqfSE8yCFDKPcM6c:grYhX2NATeSlzJqcM

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\informe bancario y motivo del pago rechazado.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4532
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2840
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:3860

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F9FED3B7-5152-4EC3-95E0-5C013EEAD39E

        Filesize

        160KB

        MD5

        b76b4ffcf9cd12d4a02a80a8465513cb

        SHA1

        a71f4abc67ccb1f919bfc0ab8f365ae576845f10

        SHA256

        b36bacd0a4ece2e3c78ccafac594ea7b93549d2528a492b0cbb1eaf73895eb3b

        SHA512

        ad79df9c394815e08884c601a21875807944f569d703194137e754471c3f1c52e7b520d77e1e4b371fceacbca13767b7ef778b7555963d2d1874c208300f00f9

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

        Filesize

        2KB

        MD5

        c5036e16e7ca2ad5b2144308aa8d12f2

        SHA1

        369b3202f1e671638732bf8285a608d3a6ef494b

        SHA256

        259a7335cda9db8ebe97ebf35ac4b0f84c2352f64844298bcb319ecfbbf2b5fe

        SHA512

        b20795b20abd16ed90a35dba4f00f67675ac422ab36c9f817213ed89ffbf9f060be468b7663cf7d262f529a32e7fb5c2e52e7265dfae5a336a28018f6f5faedd

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

        Filesize

        2KB

        MD5

        29fdc93f96fe906bb6dedd239350add9

        SHA1

        ce6fec987c54ff0b9b1380a129758b8369c73710

        SHA256

        ed0899d8f2271306149d8541553e11cac2a828afa6057b11fff32f41eca43ca8

        SHA512

        9b1aebb09823621b0f57aec3dfcb02f030035844754df77a99c1410d6b476bf752b86d49b3a26fa232650c669e26f917fc8ef607a1a77a466f12b9a7484f9234

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\20RAD7Y0\mrngunlockurpurelovetounderstandhowimportanitsitogetreadyforlovetogetgreatlovertogetgreatlover[1].doc

        Filesize

        69KB

        MD5

        90454adfffe4a15a04a97ad173fd2ca3

        SHA1

        91b00307970f914356907c4e9655e68efa6515fb

        SHA256

        82e52b61e68ba6d8644476c6b23061b528053aa8a8d1f9fd85979a77f02e7edd

        SHA512

        28dde52c89e79c52ce5a03a582aa537126e2e57d26622f977356eac9533a14e37e4943b845ae68e2393267e66a3a3ce81873ecabe4ee6994974997a15b87d6e8

      • memory/2968-36-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-31-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-121-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-40-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-41-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-70-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-69-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-51-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-50-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-47-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-43-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-45-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-44-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-48-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-38-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-35-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/2968-32-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-107-0x00007FFD01990000-0x00007FFD019A0000-memory.dmp

        Filesize

        64KB

      • memory/4532-3-0x00007FFD01990000-0x00007FFD019A0000-memory.dmp

        Filesize

        64KB

      • memory/4532-19-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-1-0x00007FFD01990000-0x00007FFD019A0000-memory.dmp

        Filesize

        64KB

      • memory/4532-18-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-110-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-5-0x00007FFD01990000-0x00007FFD019A0000-memory.dmp

        Filesize

        64KB

      • memory/4532-17-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-16-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-15-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-14-0x00007FFCFF030000-0x00007FFCFF040000-memory.dmp

        Filesize

        64KB

      • memory/4532-12-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-4-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-13-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-11-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-20-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-2-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-0-0x00007FFD01990000-0x00007FFD019A0000-memory.dmp

        Filesize

        64KB

      • memory/4532-62-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-65-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-66-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-9-0x00007FFCFF030000-0x00007FFCFF040000-memory.dmp

        Filesize

        64KB

      • memory/4532-10-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-106-0x00007FFD01990000-0x00007FFD019A0000-memory.dmp

        Filesize

        64KB

      • memory/4532-8-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-108-0x00007FFD01990000-0x00007FFD019A0000-memory.dmp

        Filesize

        64KB

      • memory/4532-109-0x00007FFD01990000-0x00007FFD019A0000-memory.dmp

        Filesize

        64KB

      • memory/4532-111-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB

      • memory/4532-7-0x00007FFD01990000-0x00007FFD019A0000-memory.dmp

        Filesize

        64KB

      • memory/4532-6-0x00007FFD41910000-0x00007FFD41B05000-memory.dmp

        Filesize

        2.0MB