8824f7c453fbe7336be90ce09ff75fcb7c47d1417f9add1dbe4e8c5f4d12e807 | Triage

Analysis

max time kernel
62s
max time network
16s
platform
windows7_x64
resource
win7
submitted
08-07-2020 18:00

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.MSExcel.Agent.BVGtr.dldr.32099.xls
Size

150KB
MD5

bdf4a40b2e0504591cdfd15560fa1d53
SHA1

3c00447bb8c797773d466124d2bc112238902968
SHA256

8824f7c453fbe7336be90ce09ff75fcb7c47d1417f9add1dbe4e8c5f4d12e807
SHA512

14fef47831bd6f502cb38bee11e06d893b346834fe4cca188959fa33f9471f609555ba235a6c00c11a862f0b2fd172ad0db4d30b38475fe3047fb42b77553c71

Score

10^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1492 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1492 EXCEL.EXE
1492 EXCEL.EXE
1492 EXCEL.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	756	1492	explorer.exe	EXCEL.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

EXCEL.EXEexplorer.exe

description	pid	process	target process
PID 1492 wrote to memory of 756	1492	EXCEL.EXE	explorer.exe
PID 1492 wrote to memory of 756	1492	EXCEL.EXE	explorer.exe
PID 1492 wrote to memory of 756	1492	EXCEL.EXE	explorer.exe
PID 1624 wrote to memory of 1508	1624	explorer.exe	WScript.exe
PID 1624 wrote to memory of 1508	1624	explorer.exe	WScript.exe
PID 1624 wrote to memory of 1508	1624	explorer.exe	WScript.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSExcel.Agent.BVGtr.dldr.32099.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\explorer.exe
explorer.exe C:\Users\Admin\AppData\Local\Temp\Ufb0JZ.vbs
2⤵
- Process spawned unexpected child process
PID:756

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ufb0JZ.vbs"
2⤵
PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ufb0JZ.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\wQTKMyIN.txt

Download Submit
memory/756-0-0x0000000000000000-mapping.dmp

Download
memory/1492-5-0x0000000004430000-0x0000000004438000-memory.dmp

Filesize
32KB

Download
memory/1508-2-0x0000000000000000-mapping.dmp

Download
memory/1508-3-0x00000000026E0000-0x00000000026E4000-memory.dmp

Filesize
16KB

Download