aa43a0173f2a2ba38d22df91178a9783c42f4e2a9a0947592a3ede9eef05f96b

Analysis

Target

ST.108.xls
Size

149KB
MD5

daa44ecf68d1e253ea6ee80264251475
SHA1

0897bd18d2e57c19d531ca5bfedcddffe19494b8
SHA256

aa43a0173f2a2ba38d22df91178a9783c42f4e2a9a0947592a3ede9eef05f96b
SHA512

c03e4aae0f13feed47d74a758593a8bbb8400caa207bb38a3e8f972e374f0a589018c16df9b85de420b806551246e52fe4dfdb9308882a729b880a88581b64c6

Score

10^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
880	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1496	880	explorer.exe	23

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1496	880	EXCEL.EXE	24
PID 880 wrote to memory of 1496	880	EXCEL.EXE	24
PID 880 wrote to memory of 1496	880	EXCEL.EXE	24
PID 904 wrote to memory of 748	904	explorer.exe	26
PID 904 wrote to memory of 748	904	explorer.exe	26
PID 904 wrote to memory of 748	904	explorer.exe	26

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\ST.108.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\explorer.exe
  explorer.exe C:\Users\Admin\AppData\Local\Temp\fP3PwKsx.vbs
  2⤵
  - Process spawned unexpected child process
  PID:1496

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fP3PwKsx.vbs"
  2⤵
  PID:748

memory/748-3-0x0000000002640000-0x0000000002644000-memory.dmp

Filesize
16KB

Download
memory/880-5-0x0000000004730000-0x0000000004738000-memory.dmp

Filesize
32KB

Download