Analysis
-
max time kernel
75s -
max time network
136s -
platform
windows10_x64 -
resource
win10 -
submitted
09-07-2020 15:58
Static task
static1
Behavioral task
behavioral1
Sample
ST.108.xls
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ST.108.xls
Resource
win10
0 signatures
0 seconds
General
-
Target
ST.108.xls
-
Size
149KB
-
MD5
daa44ecf68d1e253ea6ee80264251475
-
SHA1
0897bd18d2e57c19d531ca5bfedcddffe19494b8
-
SHA256
aa43a0173f2a2ba38d22df91178a9783c42f4e2a9a0947592a3ede9eef05f96b
-
SHA512
c03e4aae0f13feed47d74a758593a8bbb8400caa207bb38a3e8f972e374f0a589018c16df9b85de420b806551246e52fe4dfdb9308882a729b880a88581b64c6
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3676 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3216 3676 explorer.exe EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEexplorer.exedescription pid process target process PID 3676 wrote to memory of 3216 3676 EXCEL.EXE explorer.exe PID 3676 wrote to memory of 3216 3676 EXCEL.EXE explorer.exe PID 2912 wrote to memory of 2668 2912 explorer.exe WScript.exe PID 2912 wrote to memory of 2668 2912 explorer.exe WScript.exe -
Modifies registry class 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings explorer.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 3676 EXCEL.EXE 3676 EXCEL.EXE 3676 EXCEL.EXE 3676 EXCEL.EXE 3676 EXCEL.EXE 3676 EXCEL.EXE 3676 EXCEL.EXE 3676 EXCEL.EXE 3676 EXCEL.EXE 3676 EXCEL.EXE 3676 EXCEL.EXE 3676 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ST.108.xls"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\fP3PwKsx.vbs2⤵
- Process spawned unexpected child process
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fP3PwKsx.vbs"2⤵