b2ca2ad757620f4520942ab693eae848f2a714bb19ceac051ee61c376e524152

Analysis

Target

9adfacc46085440fe2b6372c6076ee02.xls
Size

178KB
MD5

9adfacc46085440fe2b6372c6076ee02
SHA1

ab433a4b1f0f2c2a2cd408df4bc4fce4b6ddd604
SHA256

b2ca2ad757620f4520942ab693eae848f2a714bb19ceac051ee61c376e524152
SHA512

923248c16fe317c680a01573fe45a7523f3030c584ba3406abb51f3cdd43703671efa46997e67726ce8775b9f24dfa735847bffddef323a317494276a4119340

Score

10^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1420	1124	explorer.exe	23

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1420	1124	EXCEL.EXE	24
PID 1124 wrote to memory of 1420	1124	EXCEL.EXE	24
PID 1124 wrote to memory of 1420	1124	EXCEL.EXE	24
PID 1452 wrote to memory of 904	1452	explorer.exe	26
PID 1452 wrote to memory of 904	1452	explorer.exe	26
PID 1452 wrote to memory of 904	1452	explorer.exe	26

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1124	EXCEL.EXE

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\9adfacc46085440fe2b6372c6076ee02.xls
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
PID:1124
- C:\Windows\explorer.exe
  explorer.exe C:\Users\Public\ixT.vbs
  2⤵
  - Process spawned unexpected child process
  PID:1420

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Public\ixT.vbs"
  2⤵
  PID:904

memory/904-3-0x00000000025A0000-0x00000000025A4000-memory.dmp

Filesize
16KB

Download
memory/1124-5-0x0000000004720000-0x0000000004728000-memory.dmp

Filesize
32KB

Download