Analysis
-
max time kernel
141s -
max time network
134s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08-07-2020 12:17
Static task
static1
Behavioral task
behavioral1
Sample
st_377.xls
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
st_377.xls
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
st_377.xls
-
Size
154KB
-
MD5
28cdbfd0bdf481f1278eddf2302072fc
-
SHA1
442aa2998ba02c341bc3fd94825c3ee0394edccd
-
SHA256
82dc27524ee531accf53dea3200f8f9ea4e7c3a9f0d49e0be1d45109ab3bc8f6
-
SHA512
dbf465c6d25ae0d385b1da0a5da43304d5c04858ac5e1b0f8b42801974332332cddcbff206a24b53979ce3e3ca3a7aa029d212451f27a3dfa9986a087a1412f7
Score
10/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 3748 EXCEL.EXE 3748 EXCEL.EXE 3748 EXCEL.EXE 3748 EXCEL.EXE 3748 EXCEL.EXE 3748 EXCEL.EXE 3748 EXCEL.EXE 3748 EXCEL.EXE 3748 EXCEL.EXE 3748 EXCEL.EXE 3748 EXCEL.EXE 3748 EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3748 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3924 3748 explorer.exe EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEexplorer.exedescription pid process target process PID 3748 wrote to memory of 3924 3748 EXCEL.EXE explorer.exe PID 3748 wrote to memory of 3924 3748 EXCEL.EXE explorer.exe PID 3544 wrote to memory of 1880 3544 explorer.exe WScript.exe PID 3544 wrote to memory of 1880 3544 explorer.exe WScript.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings explorer.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\st_377.xls"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\A2FOoXb.vbs2⤵
- Process spawned unexpected child process
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A2FOoXb.vbs"2⤵