Overview
overview
10Static
static
1JUZGADO PE...DA.exe
windows7-x64
10JUZGADO PE...DA.exe
windows10-2004-x64
10JUZGADO PE...i.pptx
windows7-x64
3JUZGADO PE...i.pptx
windows10-2004-x64
1JUZGADO PE...43.dll
windows7-x64
3JUZGADO PE...43.dll
windows10-2004-x64
3JUZGADO PE...t.xlsx
windows7-x64
3JUZGADO PE...t.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13/08/2024, 16:43
Static task
static1
Behavioral task
behavioral1
Sample
JUZGADO PENAL/07CITACION DE DEMANDA.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JUZGADO PENAL/07CITACION DE DEMANDA.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
JUZGADO PENAL/bikini.pptx
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
JUZGADO PENAL/bikini.pptx
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
JUZGADO PENAL/d3dx9_43.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
JUZGADO PENAL/d3dx9_43.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
JUZGADO PENAL/davit.xlsx
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
JUZGADO PENAL/davit.xlsx
Resource
win10v2004-20240802-en
General
-
Target
JUZGADO PENAL/davit.xlsx
-
Size
649KB
-
MD5
9451ebc3c4302304529181b29f43339b
-
SHA1
5bf89597234fd1171dba2ce160fd630f709fb53d
-
SHA256
7a91a018cff628bdb0104110da47fabe55df1ea946a04dbb42c937f60e5f16ec
-
SHA512
06da4bd965585ad2b3be98a15dd709a91ad8f403ffa5220e8584105733ffdb6027cccc0b3d6d200ac21b98290b6d750d5418c9b8cd4460c37c3c682b0a9d099e
-
SSDEEP
12288:vTRNX/yh4Vy3C7QOoun3h+rwYBSbAPLbPvXlXOYlW37hCTbRa/Qd/ZuiN:1p/yh4ICsxux6/HXkYu4/Ra/Q1Zuu
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1412 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1412 EXCEL.EXE 1412 EXCEL.EXE 1412 EXCEL.EXE 1412 EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\JUZGADO PENAL\davit.xlsx"1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1412