Extracted

• • Target

    Aviso de pago.xla

  • Size

    645KB

  • MD5

    edc3869ba8b78118979f05fbe9098b83

  • SHA1

    3129170a970c1ba4fe05b5bbe4b88a1b5da03db8

  • SHA256

    057dee21a70fecbb36618b33c27ad7c059c4ab99e0937e01fe398fb30af5bd98

  • SHA512

    9e3e435617361fc438daf3700580f702df6f38f43a2ec1105bacc23e722235168f4eca62c44850c3fc732ebc64d98e5ed932d0c8827e5c700854b868ebfeb652

  • SSDEEP

    12288:ubWNHd0zBcp2b6eTPOYlgSFG7nRzBMLu2ogAEWalBdU:6sdDMmeT2Y5WQocWi

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2