hxxps://drive[.]google[.]com/file/d/1Db-qG0aruQ_AWhxbITnLB3k-mN9CTb8n/view?usp=sharing

Analysis

max time kernel
2523s
max time network
2525s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2024 02:37

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Db-qG0aruQ_AWhxbITnLB3k-mN9CTb8n/view?usp=sharing

Score

10^/10

discovery

Malware Config

Signatures

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3892	5632	shutdown.exe	113
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4572	5632	shutdown.exe	113
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2960	5632	shutdown.exe	113
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4076	5632	shutdown.exe	113
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2212	5632	shutdown.exe	113
Parent C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE is not expected to spawn this process	2016	4236	shutdown.exe	160

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
9	drive.google.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\cachev3.dat	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-64-64-cf-d7-80	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-64-64-cf-d7-80\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-64-64-cf-d7-80\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-64-64-cf-d7-80\WpadDecisionTime = d937dbcaaf08db01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\NodeSlot = "6"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1 = 7e003100000000000259956811004465736b746f7000680009000400efbe025987633159bd142e00000075e101000000010000000000000000003e0000000000dcbd26004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e8005398e082303024b98265d99428e115f0000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0 = 60003100000000003159cc1410004d4143524f457e310000480009000400efbe315935103159cc142e00000056340200000008000000000000000000000000000000325659006d006100630072006f00200065007800630065006c00000018000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\MRUListEx = ffffffff	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 01000000030000000200000000000000ffffffff	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 0100000000000000ffffffff	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Documents"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5632	EXCEL.EXE
4236	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
4848	msedge.exe
4848	msedge.exe
3876	identity_helper.exe
3876	identity_helper.exe
3168	msedge.exe
3168	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5632	EXCEL.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	5564	7zG.exe
Token: 35	5564	7zG.exe
Token: SeSecurityPrivilege	5564	7zG.exe
Token: SeSecurityPrivilege	5564	7zG.exe
Token: SeShutdownPrivilege	5020	svchost.exe
Token: SeCreatePagefilePrivilege	5020	svchost.exe
Token: SeShutdownPrivilege	2016	shutdown.exe
Token: SeRemoteShutdownPrivilege	2016	shutdown.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
5564	7zG.exe
5084	NOTEPAD.EXE

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5084	NOTEPAD.EXE
5084	NOTEPAD.EXE
5084	NOTEPAD.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE
5632	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 1532	4848	msedge.exe	82
PID 4848 wrote to memory of 1532	4848	msedge.exe	82
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2796	4848	msedge.exe	83
PID 4848 wrote to memory of 2916	4848	msedge.exe	84
PID 4848 wrote to memory of 2916	4848	msedge.exe	84
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85
PID 4848 wrote to memory of 1136	4848	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Db-qG0aruQ_AWhxbITnLB3k-mN9CTb8n/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf28c46f8,0x7ffaf28c4708,0x7ffaf28c4718
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3297450224314287312,16666262815540165760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1376

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap7111:82:7zEvent22014
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5564

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\macro excel\Libro_habilitado_macro.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5632
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown -s -t 10 -c"Usted Esta Siendo Hackeado
  2⤵
  - Process spawned unexpected child process
  PID:3892
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown -s -t 10 -c"Usted Esta Siendo Hackeado
  2⤵
  - Process spawned unexpected child process
  PID:4572
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown -s -t 10 -c"Usted Esta Siendo Hackeado
  2⤵
  - Process spawned unexpected child process
  PID:2960
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2312
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown -s -t 10 -c"Usted Esta Siendo Hackeado
  2⤵
  - Process spawned unexpected child process
  PID:4076
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown -s -t 10 -c"Usted Esta Siendo Hackeado
  2⤵
  - Process spawned unexpected child process
  PID:2212

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\macro excel\Macro.txt
1⤵
PID:6040

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\macro excel\BAT.txt
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\macro excel\BAT.bat" "
1⤵
PID:5688
- C:\Windows\system32\xcopy.exe
  xcopy /s /i "C:\Users\Admin\Downloads\RevokeConfirm.pps\*" "C:\Users\Admin\Downloads\MOVECMD"
  2⤵
  PID:5076

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\macro excel\BAT.bat"
1⤵
PID:6132
- C:\Windows\system32\xcopy.exe
  xcopy /s /i "C:\Users\Admin\Downloads\RevokeConfirm.pps\*" "C:\Users\Admin\Downloads\MOVECMD"
  2⤵
  PID:5132

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\macro excel\BAT.bat
1⤵
PID:2268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\macro excel\BAT.bat"
1⤵
PID:1552
- C:\Windows\system32\xcopy.exe
  xcopy /s /i "C:\Users\Admin\Downloads\*" "C:\Users\Admin\Desktop\MOVECMD"
  2⤵
  PID:2192

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:3940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:4236
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown -s -t 10 -c "UstedEstaSiendoHackeado"
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of AdjustPrivilegeToken
  PID:2016

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa396c855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
a36eef049d75f98d2665167b3d1c4110

SHA1
8d5784704b4edce0883576a8d0eb44b6aaf3d233

SHA256
993e0808ff4a1998b1cc78a71f002afb12fa388bb81f9e698e3f222d118574dc

SHA512
0642fc7e7bb2bcd31aefd3b3aa18539dd08f6ca3f8ebc0ea6282c99b453479b10deb89cc88e93ee56b95d19bdc41452e8fd9e8838ccd5cce191f88c8dea5620a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
afc495da8757e3d52db1baff50ff0cad

SHA1
e98edbceebf8072944890e8324bc28cf86031f1d

SHA256
6600aeb3c56a6ac3036005dbcebb729944a96e8f501d22ee5bee90fcccc5321a

SHA512
15daebf49ef33273f792e8a77f5e6043fff74074c57558bce201abf032daee24815b319e42c7581854efc9f0bd7d81935b79af19a1745764cf791294722651c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
b1c4e7b5f9996d36e6485677c4e08183

SHA1
397dad1dcffab6a0b35b015dc73f107f9fdb6ca9

SHA256
08b17b6b6d507c310408b71838e3b751b3ea81581339a050caaad7444f935231

SHA512
08927e229020ee9f7803927ce2d698c21391f7a2fa2d6c6e96c845083ee9fc9b263d91f8a6fdf26f383d29adeabc7f2af3e6a2e3efb1e7b4fc4a12bc7adcdce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5752f36d8e5e58b2197e0cac4dac4347

SHA1
a01262e51fd4d670d1febd72d83193a39229cd21

SHA256
d83aa2d94256076eaf3d8fc88e06a0d98c0e31e2ade528cf74386acb052f330c

SHA512
bbbec0421f6095ae14feeed03e5df80e2c29b36b575ab114a83f33ade1cc56f6847a7850f26761e929e42e47fcd6711881592a97eea48ac525a529547c221a39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0f6fb9b85aeecff5e0f1b7e37f9b1b9e

SHA1
9a88202e808b552dbfc49a6ba99c39cffac30767

SHA256
1a6bf62088e9ae36f752626ff5dfdb79b0c92dd98160ab7c7ea01ecdc4b84ac1

SHA512
e1febff7ecefb662cdd81d13a9e9114747f999c8de367c7ce28a40dd769d4891cf15aa43f664bb72adc75bb897a49459cae51f089296db5131e573f49d029b73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c420166d253f5f04196981fe5d222f1f

SHA1
d9840272d3beecf2ff730da7bfc8a2f2b639c427

SHA256
d3bb859a8124ac090358c74fc80ec5705376053b8279dfdb20ed04489f45b0c6

SHA512
8bf59cdb13bee8160ef654c471a64b287f2f50ff330fce5c320cbc9bdfcd1fdc9d8ab28527ec0568fd1b564c86cf505b4f051fbfd8e27e8e9eb00d48fb44e115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
029bf34a66d541bd42bb1a219a682b2a

SHA1
41759c6ba0feca08b1cacac01ad1063aad7b84b8

SHA256
132e291c622ff72b93fe51ae54fc4ae7b7fa59216110b1d7b4c25f2ac0475eaa

SHA512
124396c2598976d400ebf32612bf2ddaf28bf8dfb8bc1a76596fbf835e4ef23cd88002a8d0f095e66711366a1d44bbf095a158e064aa0a11fbd6e727e763e694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a0a57e5f7e1440ea603444e84a457353

SHA1
350366feea2ca5035196463f7e4ed3d45bca3e2f

SHA256
a9af86d89db6b8fe80834c3c11c7b56fdb5c0a6185a6ca3954de629a17166006

SHA512
b9f60eab67483d35461265dfeee2a2f6ec4e1251340d04bc536278ef35bf217ea3e0e01de23c906ca8832f8070b3e6e96d21961b2d4e3591d3d24ac8f8c4b2eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fcf2378c11870bed5bf2065c5eee5045

SHA1
86fb56c430108c66919ec242db599200930a0903

SHA256
0c053316eee2a25877dd0f0a0f1bf4be9537228a79ae39183131c3b5dbaf4e2a

SHA512
d9c4c08e128cbabcdbab35ee20b0de896772a53cf437be319ff93ffe7f07f04a70a29fa3a0357e30b37177afc53646b88d9dc2a378f8dd90909f5fbcf4d98f53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.CampaignStates.json

Filesize
21B

MD5
f1b59332b953b3c99b3c95a44249c0d2

SHA1
1b16a2ca32bf8481e18ff8b7365229b598908991

SHA256
138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

SHA512
3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.GovernedChannelStates.json

Filesize
417B

MD5
c56ff60fbd601e84edd5a0ff1010d584

SHA1
342abb130dabeacde1d8ced806d67a3aef00a749

SHA256
200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

SHA512
acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.Settings.json

Filesize
87B

MD5
e4e83f8123e9740b8aa3c3dfa77c1c04

SHA1
5281eae96efde7b0e16a1d977f005f0d3bd7aad0

SHA256
6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

SHA512
bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyHistoryStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\8F24EE20-C58C-4B15-A8DB-C6C291BFD092

Filesize
1KB

MD5
85ad173999ed440af6120f3b4fd436fa

SHA1
eebe3bae40b0c82db581b905e2a4c4a90055c9b3

SHA256
2fb3e7ca57b5ec8657ff2b909c74dee246e7ed2b30abd60dec96fc4fb88bd165

SHA512
3c506252a27bc4a3d718fc2ad89036850ee3c9d5fd79966fc5e28debe1844d96e8d2777e160e8537034129fd8109dff027bf5eb4a082c99d0db93730ec31427e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\B7451647-9E2F-48C1-9B22-2C77D38EB6EA

Filesize
397B

MD5
2f82426450332b558a61ae9ca551abd9

SHA1
abdbf8f8bdd7572bcdefbd1e0b7da8d3cf17144d

SHA256
57d6315a8f1f11aaa111a9956ddd0d560f791f757c379ed77bbb5a1b5b577f52

SHA512
dbc43dab6cbde98647c5a88cd508a1528ef79c030286cf82cb4cb03c4af81930ad1c3b2644ead9eceea27cd5772324f42a51f04f1693102254567205a6abf0b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\403E20FB-39E4-4BE0-B21D-780805CC798C

Filesize
171KB

MD5
09234f0cc6a0fdcea5eede25dd6dede1

SHA1
31a28e1f10c1ebad1ad227d29d24f4d3b9148afd

SHA256
2b2682ad3e22ad47f0f82f7002fc0875aeb1ac75607ea47aca92fd3fb20c2840

SHA512
85fd3c684d3db2ba2d303f9dd2dcb3eddc310063f21ed63791e35659aeaa02a65785825bb9f02f219215008cc4670d8e8a0c2d3e63b3ef71904ed29f8e2ea315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
322KB

MD5
54d4dea7e2c4f8d938e102f92f8b54bf

SHA1
eba36fcc8af405ef5acc9bab5c3dccfd32feed8f

SHA256
9fddf4af60e6e787452936f2ec778c7e0f1d4dcfed991c0543f9b8b8fbae7f69

SHA512
c4d6955962782ef602c173fe3b85eb5ad0dcfcf3768cdab6d44549ab7b8fc606bd49dbca8089139a3d63fc551e1a150b5df86e9dedbf2cff0a20c3e12e6a8282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
11KB

MD5
d532854bbd3c10074f8604bc62823d9a

SHA1
0da5b6be91b51f37342b991f35dc3379fbdcb8e1

SHA256
44803c298fcca711e5242bd8e918367317a205f34543df009d2fa6556ec3eb75

SHA512
da87843b1179243fa1b27fd693066b1f7484d9343eb58ce7a19130e9ff1158df47e5361c929527f09b3980f68e51180939d8feab2b0b51a45c04bcbaf18fc23b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\Excel.officeUI

Filesize
199B

MD5
bb5b19901496babdc4c69b47ad4d23da

SHA1
16f128e7ef68fd7d568a3c832e24ea5820ed9524

SHA256
e65a3a0789d50fcbeef580aff4a60b0f0d7e8063221df5b3a14428441852b622

SHA512
99896b578daaf2d33334a33e115e7245c75d8e19ae5599d0334e4c5ecc10d02bdf2a6eedb23d9273d791ebd3a49309ef90ef20f82311d4d54fcfbb8dcb939fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Filesize
24KB

MD5
085ebd119f5fc6b8f63720fac1166ff5

SHA1
af066018aadec31b8e70a124a158736aca897306

SHA256
b8411fe8ec499074fca9047f6983d920279e84ddf3b02b2dd5c08cf07ec44687

SHA512
adb0522830db26123347cb485c43b156f5c888510e52091ba0fafc22b650ad29630c027746c920321905c28259dce7ff63dded93a79efddd5567c68312117875

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
f88ac1bff256da4f659507948a285e75

SHA1
d34de608f25955385553f85af695568f603e88fa

SHA256
4846df67018615f4429eb2a6a8ee090bdd1b5dfd3bb1c45cc495cb045a863e02

SHA512
f01c5c2113e8d84f6f9ddc9d57c5483a7aea53fc14f54b286462c821de7fb1eddb85afcdda4bfa0e8974dc55da67f6ccadc2b359974ac2537d9004fa20116707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
9b10c3aadc7d0caae5b39c37ffc4e94c

SHA1
a74c0be2d1aa14f8f798ded6390a81cafc6c2570

SHA256
2009fa29c9bb3221ecf3210b01d6401de9f86bd99936909779609c790c228950

SHA512
d761075bd09bd0911247388a6c499c56bee56a267f8b81eb456ca9139cd6795060537e9148fa5fa6e079b186a8aa3a946e38670ba0615b5a14272f83923cbd2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
04a3da9aca6329003f2def11c9eb6a1a

SHA1
c7211e488e2bf6beec84302490e60a4862ea2e83

SHA256
98e3d312349161d7748ffe2eeff6f70f210505da4085488904512087c614050b

SHA512
d8bbdca68ac89cccdea0759576872c86b7f367b493c92895b0b706fbabf488f0e0575e94449f8a6e505cd1867ba96923cd1ee0142ed77465a2bdc189258776a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Excel\Book1311318202881814141\Book1((Autorecovered-311318230124752056)).xlsb

Filesize
14KB

MD5
267414f431f5c61693f3f05bfb9b5dc6

SHA1
96f6d415b2e5dbc12f1d6fcf1a2becfd4c1a7c2e

SHA256
a1f6394fa5e84441236c2234948f8ec950d66591c06501707a09a9a1a7e6acf4

SHA512
07e51ed299c9e41dcece455edcb4d5da214b884fdcfd0db4d4f1b9ade007d8903cf06bd9140a4e6182750e7a11360fd92d1958f024803d2c18ba363a1c79e9dd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Excel\Book1311318202881814141\Book1.xlsm.lnk

Filesize
614B

MD5
ab6b05869bbb87e37a50ba5ef72843fb

SHA1
b4c37776d98697acb4f0ad4630d00ac8cc83b97a

SHA256
653360a1ef42991cab04c50407f9879ad5e1f8ab4f7eb66b4563eb647794dfbe

SHA512
cffbbaee5bc26e1873d9b58b26a0ce96f1fa92763a5d7cb8dead4cf7951f7cb8735280915e80f229a22d569aa3055d7448ff2da8c46319d04ff89f38cb76c282

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Excel\~ar1854.xar

Filesize
13KB

MD5
ac07d1b0e844ff9724e87acde5d89e17

SHA1
8f0e1411dc515a6b9486529e14b12e179ac50355

SHA256
c1ece37c89ca5b0e6b9b302b5c40f4c7304230115de5b7f4bf5c489bb5a8085a

SHA512
2a4288e9730cc17783bdb37baa7f76c0b2807ac25e9504ef2a13c3201335e6860c9ea24a58924bd750881b598aa979ef2602af58aec264c0fddb3479275d370d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\Book1.xlsm.LNK

Filesize
500B

MD5
57de4088889011a47333f15b4731241a

SHA1
51e5b4490657e95141065318252229e21e988b08

SHA256
b6a2057ef39975d00143c26aac787771c84f4685c27f9dd12322f9ad2c5126ad

SHA512
9f283e3a3500055c1d8db082393e71a45083d53afb3e66b9703192dc3eb899c7f71c6813f72980e9e42dc94b69e3ab8c6d0b2cce1e3f87109251bd530a04cbce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
271B

MD5
9f9c32550a428e63525a60a94a21fd20

SHA1
2f3e0122ba1a65a28665b4030f9a1db020dd5074

SHA256
5203152fc5270ae0720bf60b1a6e36b6ef6f29d53850b9026eacff2338407ab5

SHA512
aec354ea09351bd3b1bc6786427e08a79428e39718aa15c55de3a6b115a98ee86d12e20a40188207b23fca160d4934cf98f9ee385c81a073c39d80448a8390f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
271B

MD5
fbca434a14de5861c76c1469d1437d73

SHA1
fc3588b011f2e7431c8dbe775af56c1be41bb6d1

SHA256
89395ad79f62358c060492f6c7b5f92cd4a8bd9cc13b1beb7312cdabdd990e01

SHA512
74239e9e50f585c51e7ba16920b755b3fabb2c6ab5d86618f1ed6e398ef76ce94e5d26d4e97ca8257ffc048b727c20ce8e6ad42245764194febd7fd1ffb7874d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
271B

MD5
9fcbcac95c9223f06262a414f716d2b3

SHA1
e7388fcd8745267d1ea1611e7e37d97cfd248258

SHA256
c54a12a42dc9093a9f4d25317b8dbcbc2a8b5addf4e1014bd8c3cbc6823b7cb4

SHA512
a7fd2d7b59080fbcceac9c8387b50e3dfe460e49872902848fd557e1c4db54c68b07750511df07af1be156b43bd2df1b4f7f071b97bfa4af3792aa4eebb5cb46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
1919ef6abce5a42de9a2dfbbda11709f

SHA1
e0ccd0b0d356da0f685078c244b498cebcf731e3

SHA256
0cc230827ccbc549f995f429e354c3b8e4bddf4acdd8c6ac088fab03a187701c

SHA512
40df40e6c23905de57e7ac982f4b9b48d8f27065d172657c18eaa3bb343180e4dc5504da2a4a0b1db66032aa13a6bf326886a678d20f6bd5beb8ba1d313332e6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
2KB

MD5
28f1d613878a9a35c0c3be3f7fe08785

SHA1
e9c82d89e3b5a9bae03dda8649944877a685bf22

SHA256
d6b0940c0877e261f31621fde580a14dd7c9fbf280ca3ab1950f3750730f9827

SHA512
9870fa3d3645d9b64b3f690b1c47befeb9597c44660b52ef5fd1871d87d4701a0187380f2a74a6712e8a534d467b77a7e11e5780ad155be9e34cd41260c32d89

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
21fbb619fa06f0093a95fd7470b3bc54

SHA1
e14c944ab59fbe663e0c669f266c78a5302967fd

SHA256
8dabbe0a9ad940fea42bad658e0dabcb65da7bc40544283e599650feb96264c7

SHA512
14101a2c73f53ad29fc078da6b74313dcaa2554ddcf6e113f022c50ad4672c71dc78527a9f77bcc31eb14f0bf8c9acf124e6a0b1b90bf393277de320d41b93af

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
7f0a8789554274b06fecc8abe0f1f8bf

SHA1
a665042995bba3b133d33b017ed8a5695657207a

SHA256
f31511b98a7d87500039a265e5a345093f1a7b58eb334807da0b01c724442744

SHA512
60cf17ce815af85c89e416488088a172751fd9e6a38b8690444af82f972bdbb9c05253a0017db9365b67c25faf41478529e84f4fd386d36992019447a5a6d8ac

Download Submit
C:\Users\Admin\Desktop\0A646E00

Filesize
15KB

MD5
d70a0d8ccc4a64647d707000266efa71

SHA1
d635929d3074bb8b03bcc410cc529fe592b93cba

SHA256
4ec64974061b15ddbf809bc729de125746fb6edc021716c131738c0bbbabb023

SHA512
225a44cd82c895cd9b199049e8c3c33804a951d9ec6ac2412cff0aa0b7ccbccf9fa2c14105c30f78413bdde9ec796d698020ea7153974b515fc4adabbb52c7a5

Download Submit
C:\Users\Admin\Desktop\61A27E00

Filesize
14KB

MD5
5238b84b63bdec9917511ec8ab9f35ff

SHA1
0fe1ca85334c98d0801ea36725d86b251c3e2e41

SHA256
584922c124c9f2eaf605e058ca9426b899481a8ec12e23b045a6267794c8e01a

SHA512
3470ec55e99baedf3545c636070678b9b4b193a9592aa344bd513ca862fe3a5e71e7e361133289eaf7bf0509e0400e095a65ee59c666bd613247f0dd4bcea279

Download Submit
C:\Users\Admin\Desktop\727B6E00

Filesize
15KB

MD5
4ccf27057ddec35a56799ccbd707356d

SHA1
7c119ce352489f19d047fd90158d9fc6a62ba4e6

SHA256
8ca87fbaa3b3231db6d74e6499f8ab0456323e5d9521d9e05eca70bc42d0eece

SHA512
b7124f91da24b20ce3e6cf274f64ff3874e99ec95d05f704150fb685fd41ba036f3824c6e9251952199d1389fc1eddd9521348d54800fc5186fabf3f09e83f49

Download Submit
C:\Users\Admin\Desktop\Book1.xlsm

Filesize
8KB

MD5
4ddf08a742d7bceef8c23fe1f66fd9c4

SHA1
ca390d2995f703c88aad8895cc4f895b38ad0263

SHA256
ad49bd6e7656274c9768bd0bd7c7c02f6099396b8bd3553e186ee81566e597e8

SHA512
e22ea156a7231efc86e769f46f0ccf176a65b3f93f19849b2438ac9b864ef179af1217b8c18bd156c81b6981223e156a95ddbfd3aa91fa6a91ad078ad3c88944

Download Submit
C:\Users\Admin\Desktop\FD527E00

Filesize
14KB

MD5
3cded5bd9833d5ad17f6f546a3b9c915

SHA1
91bdd41a18b707e85a1c2d920a438a2d12228aa0

SHA256
e1243d0371bfe434728c7209b08261b2e4ac0d43b1f99224856b52e8f787404c

SHA512
e2fdb2078dd1405bc494daf12bab17f52abe49e00efe3bbbfbf35c78826a28858ca25d98ab6faf80fc26f9f6a1d0b028c7bac4dc6de55e7311225ab1df740430

Download Submit
C:\Users\Admin\Documents\Book1.xlsm

Filesize
14KB

MD5
79e7326ba74c54ba4b165885cb8ceed0

SHA1
cf7c0e95ec3ec0fe5e3d546498c8df446ddbc0a1

SHA256
d54a3b48bc9b098d3affd134fb5cedca91261b9bf55ac4573688244f5611474f

SHA512
519aed5508982e86bc945419cf64b914739c79d78d031336db568797f3226fd95ced9ad0ab55fc928c19526fb61d0d38c8240b369ade7c993dcb86d9c743c42a

Download Submit
C:\Users\Admin\Downloads\macro excel.7z

Filesize
4KB

MD5
1454ebcd006f435399d1f31181321c43

SHA1
373846ea39bfa0cbc69007e76fc459d8b48d63c5

SHA256
cf8b81d4b8ee3a61d3b4d21d5c6e1425e594dc469b38f8c8d64ecbd59c30ba8b

SHA512
49e7d9f67ad5fa79fb83c7f0e13ba2709686d376f7a397569468ef4a2cb049208fbcfd2cf02b85ae612115f3ff2b13ac11439373e97ef6a063fc1a54d4702b7c

Download Submit
C:\Users\Admin\Downloads\macro excel\BAT.bat

Filesize
494B

MD5
62ea7d6849e79e0bd5ec115bdde50511

SHA1
ecbc56c4a7d389425c807978d27cfaaa9fa3ce70

SHA256
cec98e30a4a5f064a1ea87f9017e524f00102fcdeb7a119937978d7f4b475f14

SHA512
0b4b7a89a87b07c83d11339422dcddd97d7491f962e14f4fa3cc4e04a2357d63a4f46cd4b1fed3ecd94672decb1a272f41dcf5ea31fc0e3c20081080fe2eefd6

Download Submit
C:\Users\Admin\Downloads\macro excel\BAT.bat

Filesize
474B

MD5
fcd2576489f32087b474f1622c259b80

SHA1
1d3d59c469f445843e1891cafd73741fdfcb5499

SHA256
b51c8d4d06fe1c9ec7e02e77f9ddef28cf0a13b996c0290906f153dbf6fc21e6

SHA512
fa24cbcfec2ccc410852683587e1471215909a392c755b4633f8d2ad77a875e3154d83e829dfdf7287477f7a4097aee2fb642e8d21ef945a39bb9c36e5dfad66

Download Submit
C:\Users\Admin\Downloads\macro excel\Libro_habilitado_macro.xlsm

Filesize
4KB

MD5
004720531b268a31cbdb2a6260bae043

SHA1
d19aa7841ac9f2d9feb4107ce0b1cf9e7ce64767

SHA256
a51ca630f495bfa90933caa175345e5b064f8c24bee0dd1409ba4d2ac5166945

SHA512
e34096dac8fbd11bb0ef1d8ab0dc5bf0821e6cfb89dd20f4fd1b27743a11dfc71b71409d291043995baf83e39301e851e4ab013e1a7003525b25cca8bc2329fd

Download Submit
C:\Users\Admin\Downloads\macro excel\Macro.txt

Filesize
449B

MD5
82e6e89d8bbc7d9567cb8ca29cafaa7d

SHA1
a7a0ec02f1abf841df974aa2a6ca709d7bbca2ab

SHA256
46889a2a31b4eb68d1d3cbe0753ca795549d3dd7f0ee7aafb7e546ae2c415752

SHA512
c39bbb8796fb3b7bc8f2177c53139fe7fbddf25849deae4c63090fa5d00d7cb5ee5e0c004a03e36d399d1472cc9eebe24dea17f1d91319e5757421b83da3623b

Download Submit
memory/5632-604-0x00007FFAC0AF0000-0x00007FFAC0B00000-memory.dmp

Filesize
64KB

Download
memory/5632-607-0x00007FFAC0AF0000-0x00007FFAC0B00000-memory.dmp

Filesize
64KB

Download
memory/5632-605-0x00007FFAC0AF0000-0x00007FFAC0B00000-memory.dmp

Filesize
64KB

Download
memory/5632-236-0x00007FFABE190000-0x00007FFABE1A0000-memory.dmp

Filesize
64KB

Download
memory/5632-235-0x00007FFABE190000-0x00007FFABE1A0000-memory.dmp

Filesize
64KB

Download
memory/5632-234-0x00007FFAC0AF0000-0x00007FFAC0B00000-memory.dmp

Filesize
64KB

Download
memory/5632-232-0x00007FFAC0AF0000-0x00007FFAC0B00000-memory.dmp

Filesize
64KB

Download
memory/5632-233-0x00007FFAC0AF0000-0x00007FFAC0B00000-memory.dmp

Filesize
64KB

Download
memory/5632-231-0x00007FFAC0AF0000-0x00007FFAC0B00000-memory.dmp

Filesize
64KB

Download
memory/5632-230-0x00007FFAC0AF0000-0x00007FFAC0B00000-memory.dmp

Filesize
64KB

Download
memory/5632-606-0x00007FFAC0AF0000-0x00007FFAC0B00000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads