Analysis
-
max time kernel
99s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
06/06/2024, 15:59
General
-
Target
Orden de compra.xls
-
Size
398KB
-
MD5
feadbeab04cafce5ef327b3c712019b7
-
SHA1
fb0ad6fb394d7098b176fcf72f4bf392010ec2d9
-
SHA256
71533a30ee9f92a67081b457464ec85564d0b6b1bf38004091305ca3ee70ab75
-
SHA512
cacd9712b56ee21d16c19e9e09f4c8108bc14ab561f215060a2210cb7dcaf80e6fbb418bb0658ac755521bea868a9d0d7f74a5a51e8da2dec8ea793b5f02ba45
-
SSDEEP
12288:9qFzu4LjCgPGp3m5JmKGcBE/7xjjijt4lOhiN/Xne:azu4LjvCI4VzF2jlhyve
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Orden de compra.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bd8ab302c2a4f71ae273d638a185fc5e
SHA1518f300d427a642ad45dacec31e75bb6570439fe
SHA256bc8d69eef1cf73c1b2900dfa80bb9aae47c428bfbad4f901fef599717be5f98b
SHA5125645af08e5dbf5933455cb4ea38924db39dc3a4ea9be768bbe3076eba2075ccaf1223b395efa150d5496cc615ba708bbfac31ccfbe5c07be6f2fad03cb01a986
-
Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
Filesize
471B
MD5be0f80225826889a820e84d22d8b3438
SHA17dfdd3ad6d5149b1e6a0f1aec907b947a1248087
SHA25613b3a9d744988146e7c4d4cd27c4b2cce75495fc39cb90d8df16ff80438ce1e1
SHA5126124217bb9f9e793da57f74ad7f852d2552b0f6ae1448a710b4356db2359798540f4b25506300307c48be3b1f2ad3b65bc8776072a028ed6aeb5cbea22785975
-
Filesize
410B
MD5552511df3047f2d36ecf466fecbe2b6c
SHA1bbbd5138655eff4e9d8a1f35ab6246b99012079a
SHA2564de1bc3ffb514a084015233d1de813fb206fcb723a26154ef0f21aa266441beb
SHA5126d0099b31df926da58baf1d7182076c33df5f6bf4db0c4c6b9ead433d85d028ca1e813e827783d514700e358b341e7e17230d3aec8dee30cfa225aa87a981566
-
Filesize
392B
MD5eeda7d31b4c7020ab5d7abf812525e9c
SHA1816acb7b8816e198fe8b343b693211dc34c5f9b5
SHA256c7d716a6d6e64957cfb983d132d8d93b4ae6bb498878be46c1ff611594ae6822
SHA51234a919dad94d24e6dea21fa0c39a2849395ef0de25b6bd794f0d792a39a76c1f7862002af0c95f112752c6d6bd0d1bdc660f8333c174defe22f6618d4ab07586
-
Filesize
412B
MD535c472b65ff4590642fd65f65c7c4b65
SHA1d29037e7d964443e2650ecd397706da78406ba3c
SHA256b8579b5139ac17ae6a7dee39d12e8bfa2032c18acf46e3f09b40ba2d35486411
SHA5126d3bec9ca6bde0bbb0266631b27341a5e7fc281915e6b3d3ed6d87a56eb2d93d584a513d3f9a5fa6ee1c5d86f72d35622cb1c93ca205d2e75bd7e54db9be7b81
-
Filesize
161KB
MD573a6b5164ff14d182baee8936496f948
SHA17d3561f1953931726077856ce6fd0fca4bbb0050
SHA25648b62f1b49505e56b7a4f3934b956990fcabfe6f17e6ee9f1e73e961798b88ac
SHA512471f49103ff35778c123b07a3d3016042816f04e1d05d6588b7bfb31394dacf8a193a7ecd0ab5e0733010611177f3e9ceb1aa679db6ecfabdbb71d7ea3e66d0c
-
Filesize
21KB
MD5619088292bcc04b31f05e8e63999b6dd
SHA106c52d0980022bf179bc892d07aa398a0834f907
SHA25688553e4da32bbd9291e4cb41e9dc49f363a514343c1c6ea021fcf54dc70e8c45
SHA5124a0b209d4c89c65a2e6b73f2d3bd4ee1b96dab1d7f54b95b2b5398826b231c124013f4cd52d61918e52b3df74d4dab217794892765a2386cb3cd7e3888d4d610
-
Filesize
2KB
MD589db0bf01dd0896c9a9de8809cec2b1e
SHA1497c1e2eda3a2eae3d135d705ca45f3c42f746b9
SHA256b1c630a82d883abdd9f0ec8f86584aa5fb68114051842ed027d666b3107a6ec8
SHA51287e8c949abc46f65c8af8a5a193f486b0c7173ca93bc62d7cfb8b289c339e5d38451da4f3339944f56a7e1f9c84477e56da1673982c79eedf1ac22245a9d606e
-
Filesize
2KB
MD50ea4bc84492508f7d145331819021b7f
SHA125d147f34436b20aaf4134c166680146a5978561
SHA256ce9cd5c26204a8f6fc49628b19f8257120999ed9141ac893c5d551a9f7c94583
SHA5122c3db5a22fd7d4cfd35963eda54869d7e611d28bc1e462a1613abcb038dae12e25474388415a73c0d6ce22f027917d2a583d63b0ed1c89c54cea3ac3c30ff729
-
Filesize
43KB
MD520d369963aa62c1085bc7282c111c410
SHA14520e4bae9d15af480c4347abbee95b255fcdd6b
SHA256dd31b9a658a0172da4b5a76b5529e5b0c96dd6949cca7fee2f44c4e3039fccef
SHA51279bd60bd35f06e955797658ec3cf3d78c74ec25e7fb19120e1e88b019d1041028671e0a2c1038157ed64d1d58253ec316450c2208d0a8801bd32ad11670e5e73
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
229B
MD5833e7b970627444f7e9861d1b73f0554
SHA19c757b1bfc2b688443924835e33599dc46fd9d3a
SHA256833be5e9de7c2411285f2dd89940d68a6c840099db0bcfe466ae1cda364192a7
SHA5126a1908290bcadd6528819e9d8a41ef209ed5a9063a31baa3f878a912dd900df91eee90d1fb097462c1d0c8f63607e5eecb048beaf18ce1e9cc412b17f6b44457
-
Filesize
3KB
MD561aa8a18de906245d8c7b92a228de774
SHA12e22d451de93276a9bc4f4c4591a997f4ab00ebd
SHA2561f30d0f865044fc415ba2faf1f5da081cae1024364d5c71ecabfc578bf968f48
SHA5125cdcc4a5964dd86afbdd7e561b131f91ceaf2550d832718c5842aee9505731b1e0112df5212283b2f248799f33f0015865182c4ce4d1f53fc70d09175c2f26ee
-
Filesize
5KB
MD5e8a45cb42698ea18d63b6f696daa201b
SHA1e668decac94527eb4cd6e9478dc9f8c8eefdad24
SHA256064a844739d56808bf86b8258abf66460512713ea31b5f9adaee4dcf86d6b1e4
SHA512ca2ea61970bd517c2d3ca147b14b05f747716a34f8ca76a278d463d1683de5e57e4b2f8922684184b8f34b8c7c9b30b2bc7dca81f57d0c7578809e06e52265bc
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
868KB