Analysis
-
max time kernel
62s -
max time network
16s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 18:00
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.MSExcel.Agent.BVGtr.dldr.32099.xls
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.MSExcel.Agent.BVGtr.dldr.32099.xls
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.MSExcel.Agent.BVGtr.dldr.32099.xls
-
Size
150KB
-
MD5
bdf4a40b2e0504591cdfd15560fa1d53
-
SHA1
3c00447bb8c797773d466124d2bc112238902968
-
SHA256
8824f7c453fbe7336be90ce09ff75fcb7c47d1417f9add1dbe4e8c5f4d12e807
-
SHA512
14fef47831bd6f502cb38bee11e06d893b346834fe4cca188959fa33f9471f609555ba235a6c00c11a862f0b2fd172ad0db4d30b38475fe3047fb42b77553c71
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1492 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1492 EXCEL.EXE 1492 EXCEL.EXE 1492 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 756 1492 explorer.exe EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
EXCEL.EXEexplorer.exedescription pid process target process PID 1492 wrote to memory of 756 1492 EXCEL.EXE explorer.exe PID 1492 wrote to memory of 756 1492 EXCEL.EXE explorer.exe PID 1492 wrote to memory of 756 1492 EXCEL.EXE explorer.exe PID 1624 wrote to memory of 1508 1624 explorer.exe WScript.exe PID 1624 wrote to memory of 1508 1624 explorer.exe WScript.exe PID 1624 wrote to memory of 1508 1624 explorer.exe WScript.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSExcel.Agent.BVGtr.dldr.32099.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\Ufb0JZ.vbs2⤵
- Process spawned unexpected child process
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ufb0JZ.vbs"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Ufb0JZ.vbs
-
C:\Users\Admin\AppData\Local\Temp\wQTKMyIN.txt
-
memory/756-0-0x0000000000000000-mapping.dmp
-
memory/1492-5-0x0000000004430000-0x0000000004438000-memory.dmpFilesize
32KB
-
memory/1508-2-0x0000000000000000-mapping.dmp
-
memory/1508-3-0x00000000026E0000-0x00000000026E4000-memory.dmpFilesize
16KB