82dc27524ee531accf53dea3200f8f9ea4e7c3a9f0d49e0be1d45109ab3bc8f6 | Triage

Analysis

max time kernel
62s
max time network
17s
platform
windows7_x64
resource
win7
submitted
08-07-2020 12:17

Sharing

Report Analysis Logs

General

Target

st_377.xls
Size

154KB
MD5

28cdbfd0bdf481f1278eddf2302072fc
SHA1

442aa2998ba02c341bc3fd94825c3ee0394edccd
SHA256

82dc27524ee531accf53dea3200f8f9ea4e7c3a9f0d49e0be1d45109ab3bc8f6
SHA512

dbf465c6d25ae0d385b1da0a5da43304d5c04858ac5e1b0f8b42801974332332cddcbff206a24b53979ce3e3ca3a7aa029d212451f27a3dfa9986a087a1412f7

Score

10^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1588 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1588 EXCEL.EXE
1588 EXCEL.EXE
1588 EXCEL.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1104	1588	explorer.exe	EXCEL.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

EXCEL.EXEexplorer.exe

description	pid	process	target process
PID 1588 wrote to memory of 1104	1588	EXCEL.EXE	explorer.exe
PID 1588 wrote to memory of 1104	1588	EXCEL.EXE	explorer.exe
PID 1588 wrote to memory of 1104	1588	EXCEL.EXE	explorer.exe
PID 1032 wrote to memory of 1504	1032	explorer.exe	WScript.exe
PID 1032 wrote to memory of 1504	1032	explorer.exe	WScript.exe
PID 1032 wrote to memory of 1504	1032	explorer.exe	WScript.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\st_377.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\explorer.exe
explorer.exe C:\Users\Admin\AppData\Local\Temp\A2FOoXb.vbs
2⤵
- Process spawned unexpected child process
PID:1104

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A2FOoXb.vbs"
2⤵
PID:1504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A2FOoXb.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\mE8gE9.txt

Download Submit
memory/1104-0-0x0000000000000000-mapping.dmp

Download
memory/1504-2-0x0000000000000000-mapping.dmp

Download
memory/1504-3-0x0000000002680000-0x0000000002684000-memory.dmp

Filesize
16KB

Download
memory/1588-5-0x0000000004850000-0x0000000004858000-memory.dmp

Filesize
32KB

Download