00eb5cd0eabd4fd5d9f9ba99581cd5bd15b9fcbba647134b9a5c77370bbfdf99

Analysis

Target

notifica_0807_4059.xls
Size

149KB
MD5

0658e5427d77225baff4f141546fe42b
SHA1

010d7629298c8185d9722156638c3fb325c5aa95
SHA256

00eb5cd0eabd4fd5d9f9ba99581cd5bd15b9fcbba647134b9a5c77370bbfdf99
SHA512

c47dcdff7ebfd1b0d68a8852e36d6b6d643f4692fb139e8d1aa1511239b4ac311d714014350bce83d441dd7bbe0bfe7017248b8520d8edf02e64127716241305

Score

10^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

376 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

376 EXCEL.EXE
376 EXCEL.EXE
376 EXCEL.EXE

pid	process
376	EXCEL.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1512	376	explorer.exe	EXCEL.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

EXCEL.EXEexplorer.exe

description	pid	process	target process
PID 376 wrote to memory of 1512	376	EXCEL.EXE	explorer.exe
PID 376 wrote to memory of 1512	376	EXCEL.EXE	explorer.exe
PID 376 wrote to memory of 1512	376	EXCEL.EXE	explorer.exe
PID 1368 wrote to memory of 1800	1368	explorer.exe	WScript.exe
PID 1368 wrote to memory of 1800	1368	explorer.exe	WScript.exe
PID 1368 wrote to memory of 1800	1368	explorer.exe	WScript.exe

C:\Windows\explorer.exe
explorer.exe C:\Users\Admin\AppData\Local\Temp\Jc6Po8cW.vbs
2⤵
- Process spawned unexpected child process
PID:1512

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Jc6Po8cW.vbs"
2⤵
PID:1800

C:\Users\Admin\AppData\Local\Temp\Jc6Po8cW.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\MtV2WOY.txt

Download Submit
memory/376-0-0x0000000006D50000-0x0000000006D51000-memory.dmp

Filesize
4KB

Download
memory/376-6-0x0000000004810000-0x0000000004818000-memory.dmp

Filesize
32KB

Download
memory/1512-1-0x0000000000000000-mapping.dmp

Download
memory/1800-3-0x0000000000000000-mapping.dmp

Download
memory/1800-4-0x00000000024C0000-0x00000000024C4000-memory.dmp

Filesize
16KB

Download