74c6635afb5f71d4287d0a7d395fb520aa2bf2270db94fc5e803e36915adaec5 | Triage

Analysis

max time kernel
100s
max time network
72s
platform
windows7_x64
resource
win7
submitted
09-07-2020 11:59

Sharing

Report Analysis Logs

General

Target

74c6635afb5f71d4287d0a7d395fb520aa2bf2270db94fc5e803e36915adaec5.xls
Size

259KB
MD5

3ef913578008d513c043b43fbf7af2fe
SHA1

e5d257e81051c5a84436a362264a499a260deee0
SHA256

74c6635afb5f71d4287d0a7d395fb520aa2bf2270db94fc5e803e36915adaec5
SHA512

f6cf9d9c1c27f37f04e15c9391dfe8b1afd666f7531ef217d1f41515468121b12b5ca00f07c946a7ad5c7ba93f763341f155b49455525fdada6295f3edd05337

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1492 EXCEL.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

EXCEL.EXE

pid process

1492 EXCEL.EXE
1492 EXCEL.EXE
1492 EXCEL.EXE
1492 EXCEL.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

EXCEL.EXE

pid process

1492 EXCEL.EXE
Office loads VBA resources, possible macro or embedded object present

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\74c6635afb5f71d4287d0a7d395fb520aa2bf2270db94fc5e803e36915adaec5.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: GetForegroundWindowSpam
PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...