57526978347b4a435a44c0ca55149ac9cd8bdb0def66c73df52cda81ac8b5546 | Triage

Resubmissions

07-07-2020 11:46

200707-l66r2vh3ha 1

07-07-2020 11:42

200707-mrc92g3k5j 1

07-07-2020 11:12

200707-8s9ccyfyp2 1

Analysis

max time kernel
130s
max time network
136s
platform
windows7_x64
resource
win7
submitted
07-07-2020 11:12

Sharing

Report Analysis Logs

General

Target

URGENT.xlsx
Size

85KB
MD5

d79b99270ed6b1a7767fa1e62ced9e20
SHA1

03caddc36c3501dfa28b69113506a597953ee901
SHA256

57526978347b4a435a44c0ca55149ac9cd8bdb0def66c73df52cda81ac8b5546
SHA512

14148b0656d00c09f455126c3bc6c787e06eee23a7a7c49577f6c9f7f03ee19b8f64dd0405bfe84db600bcf6599e3e030b5a4d4360b524ed90fe73428941c076

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1612 EXCEL.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

EXCEL.EXE

pid process

1612 EXCEL.EXE
1612 EXCEL.EXE
1612 EXCEL.EXE
1612 EXCEL.EXE
1612 EXCEL.EXE
1612 EXCEL.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

notepad.exe

pid process

1872 notepad.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\URGENT.xlsx
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1612

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-2-0x0000000005A80000-0x0000000005A84000-memory.dmp

Filesize
16KB

Download