aa43a0173f2a2ba38d22df91178a9783c42f4e2a9a0947592a3ede9eef05f96b | Triage

Analysis

max time kernel
151s
max time network
6s
platform
windows7_x64
resource
win7v200430
submitted
09-07-2020 15:58

Sharing

Report Analysis Logs

General

Target

ST.108.xls
Size

149KB
MD5

daa44ecf68d1e253ea6ee80264251475
SHA1

0897bd18d2e57c19d531ca5bfedcddffe19494b8
SHA256

aa43a0173f2a2ba38d22df91178a9783c42f4e2a9a0947592a3ede9eef05f96b
SHA512

c03e4aae0f13feed47d74a758593a8bbb8400caa207bb38a3e8f972e374f0a589018c16df9b85de420b806551246e52fe4dfdb9308882a729b880a88581b64c6

Score

10^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

880 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

880 EXCEL.EXE
880 EXCEL.EXE
880 EXCEL.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1496	880	explorer.exe	EXCEL.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

EXCEL.EXEexplorer.exe

description	pid	process	target process
PID 880 wrote to memory of 1496	880	EXCEL.EXE	explorer.exe
PID 880 wrote to memory of 1496	880	EXCEL.EXE	explorer.exe
PID 880 wrote to memory of 1496	880	EXCEL.EXE	explorer.exe
PID 904 wrote to memory of 748	904	explorer.exe	WScript.exe
PID 904 wrote to memory of 748	904	explorer.exe	WScript.exe
PID 904 wrote to memory of 748	904	explorer.exe	WScript.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\ST.108.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\explorer.exe
explorer.exe C:\Users\Admin\AppData\Local\Temp\fP3PwKsx.vbs
2⤵
- Process spawned unexpected child process
PID:1496

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fP3PwKsx.vbs"
2⤵
PID:748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RfHtQ.txt

Download Submit
C:\Users\Admin\AppData\Local\Temp\fP3PwKsx.vbs

Download Submit
memory/748-2-0x0000000000000000-mapping.dmp

Download
memory/748-3-0x0000000002640000-0x0000000002644000-memory.dmp

Filesize
16KB

Download
memory/880-5-0x0000000004730000-0x0000000004738000-memory.dmp

Filesize
32KB

Download
memory/1496-0-0x0000000000000000-mapping.dmp

Download