Analysis
-
max time kernel
62s -
max time network
17s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 12:17
Static task
static1
Behavioral task
behavioral1
Sample
st_377.xls
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
st_377.xls
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
st_377.xls
-
Size
154KB
-
MD5
28cdbfd0bdf481f1278eddf2302072fc
-
SHA1
442aa2998ba02c341bc3fd94825c3ee0394edccd
-
SHA256
82dc27524ee531accf53dea3200f8f9ea4e7c3a9f0d49e0be1d45109ab3bc8f6
-
SHA512
dbf465c6d25ae0d385b1da0a5da43304d5c04858ac5e1b0f8b42801974332332cddcbff206a24b53979ce3e3ca3a7aa029d212451f27a3dfa9986a087a1412f7
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1588 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1588 EXCEL.EXE 1588 EXCEL.EXE 1588 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1104 1588 explorer.exe EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
EXCEL.EXEexplorer.exedescription pid process target process PID 1588 wrote to memory of 1104 1588 EXCEL.EXE explorer.exe PID 1588 wrote to memory of 1104 1588 EXCEL.EXE explorer.exe PID 1588 wrote to memory of 1104 1588 EXCEL.EXE explorer.exe PID 1032 wrote to memory of 1504 1032 explorer.exe WScript.exe PID 1032 wrote to memory of 1504 1032 explorer.exe WScript.exe PID 1032 wrote to memory of 1504 1032 explorer.exe WScript.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\st_377.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\A2FOoXb.vbs2⤵
- Process spawned unexpected child process
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A2FOoXb.vbs"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\A2FOoXb.vbs
-
C:\Users\Admin\AppData\Local\Temp\mE8gE9.txt
-
memory/1104-0-0x0000000000000000-mapping.dmp
-
memory/1504-2-0x0000000000000000-mapping.dmp
-
memory/1504-3-0x0000000002680000-0x0000000002684000-memory.dmpFilesize
16KB
-
memory/1588-5-0x0000000004850000-0x0000000004858000-memory.dmpFilesize
32KB