Extracted

• • Target

    Orden de compra.xla

  • Size

    657KB

  • MD5

    1048471113b938176f93411516da0960

  • SHA1

    42711353d0c65d1d7e7b16fceb81d6d23a08d286

  • SHA256

    a3fddc5f8fdb4f125ad3604d28d603947a6ccf1dacbc1fbb910d3c773f70dcbe

  • SHA512

    d2ecacfe828afaf1c41a5f08f9292dfa92f51bb85a47fbb4a9d0a87572c9f48001d352032a4c33c3b7919895ab9db674a1af3f210b36eda6848f86eda9f3a582

  • SSDEEP

    12288:/7dWr5iDaBPSGJ6E30oXeu9rjjYdLXGnJ8eS//9BfXBg8u:cAaBSGDbXeL6S//zfB

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2