Overview
overview
5Static
static
1valid.eml
windows7-x64
5valid.eml
windows10-2004-x64
3DetallePla...2).xls
windows7-x64
1DetallePla...2).xls
windows10-2004-x64
1DetallePla...2).xls
windows7-x64
1DetallePla...2).xls
windows10-2004-x64
1DetallePla...2).xls
windows7-x64
1DetallePla...2).xls
windows10-2004-x64
1DetallePla...2).xls
windows7-x64
1DetallePla...2).xls
windows10-2004-x64
1DetallePla...2).xls
windows7-x64
1DetallePla...2).xls
windows10-2004-x64
1DetallePla..._N.xls
windows7-x64
1DetallePla..._N.xls
windows10-2004-x64
1DetallePla..._N.xls
windows7-x64
1DetallePla..._N.xls
windows10-2004-x64
1DetallePla..._N.xls
windows7-x64
1DetallePla..._N.xls
windows10-2004-x64
1email-html-2.txt
windows7-x64
1email-html-2.txt
windows10-2004-x64
1email-plain-1.txt
windows7-x64
1email-plain-1.txt
windows10-2004-x64
1Analysis
-
max time kernel
135s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
valid.eml
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
valid.eml
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
DetallePlanilla_17772528_2020_04_E (2).xls
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
DetallePlanilla_17772528_2020_04_E (2).xls
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
DetallePlanilla_17772529_2020_04_E (2).xls
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
DetallePlanilla_17772529_2020_04_E (2).xls
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
DetallePlanilla_18086055_2020_05_E (2).xls
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
DetallePlanilla_18086055_2020_05_E (2).xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
DetallePlanilla_18086071_2020_05_E (2).xls
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
DetallePlanilla_18086071_2020_05_E (2).xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
DetallePlanilla_18341724_2020_04_E (2).xls
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
DetallePlanilla_18341724_2020_04_E (2).xls
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
DetallePlanilla_18467555_2020_05_N.xls
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
DetallePlanilla_18467555_2020_05_N.xls
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
DetallePlanilla_20717119_2020_04_N.xls
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
DetallePlanilla_20717119_2020_04_N.xls
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
DetallePlanilla_20717131_2020_04_N.xls
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
DetallePlanilla_20717131_2020_04_N.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
email-html-2.txt
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
email-html-2.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
email-plain-1.txt
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
email-plain-1.txt
Resource
win10v2004-20240508-en
General
-
Target
DetallePlanilla_18341724_2020_04_E (2).xls
-
Size
45KB
-
MD5
68eaac1fa9bd16944399a263c3ca9053
-
SHA1
1fd032bff62a897a54e04b5c1f8c5fea9d1c3595
-
SHA256
ffb0ffc75c808285d8cbe7e6e3fc94ec34c2a7a26840a24d3490090ae42afa83
-
SHA512
073e9be0e251982d7272082587d499b40c7178d3239fad2ec42ac344432195348dc24ea3e7b294f62104e3abaca824a0a734efb702600509c4426f8ab8a8f19f
-
SSDEEP
768:wsF87JYY+ij5Vxd+05hURfn0uVSMDs0ip9gqyk:W7CYV5Ld+0vURZVSMDs0ibgqyk
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2916 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\DetallePlanilla_18341724_2020_04_E (2).xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2916