Analysis
-
max time kernel
151s -
max time network
6s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 15:58
Static task
static1
Behavioral task
behavioral1
Sample
ST.108.xls
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ST.108.xls
Resource
win10
0 signatures
0 seconds
General
-
Target
ST.108.xls
-
Size
149KB
-
MD5
daa44ecf68d1e253ea6ee80264251475
-
SHA1
0897bd18d2e57c19d531ca5bfedcddffe19494b8
-
SHA256
aa43a0173f2a2ba38d22df91178a9783c42f4e2a9a0947592a3ede9eef05f96b
-
SHA512
c03e4aae0f13feed47d74a758593a8bbb8400caa207bb38a3e8f972e374f0a589018c16df9b85de420b806551246e52fe4dfdb9308882a729b880a88581b64c6
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 880 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 880 EXCEL.EXE 880 EXCEL.EXE 880 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1496 880 explorer.exe EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
EXCEL.EXEexplorer.exedescription pid process target process PID 880 wrote to memory of 1496 880 EXCEL.EXE explorer.exe PID 880 wrote to memory of 1496 880 EXCEL.EXE explorer.exe PID 880 wrote to memory of 1496 880 EXCEL.EXE explorer.exe PID 904 wrote to memory of 748 904 explorer.exe WScript.exe PID 904 wrote to memory of 748 904 explorer.exe WScript.exe PID 904 wrote to memory of 748 904 explorer.exe WScript.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\ST.108.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\fP3PwKsx.vbs2⤵
- Process spawned unexpected child process
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fP3PwKsx.vbs"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RfHtQ.txt
-
C:\Users\Admin\AppData\Local\Temp\fP3PwKsx.vbs
-
memory/748-2-0x0000000000000000-mapping.dmp
-
memory/748-3-0x0000000002640000-0x0000000002644000-memory.dmpFilesize
16KB
-
memory/880-5-0x0000000004730000-0x0000000004738000-memory.dmpFilesize
32KB
-
memory/1496-0-0x0000000000000000-mapping.dmp