d1ec88f75d1134f2df67601950a89d727579cadcd69c34a53ab11847aee99e0e

Analysis

Target

order-649.xls
Size

148KB
MD5

0e08cfc72b49a23f004c5a944b69478f
SHA1

8f55d06882f10d0e2d1f42b020e836ae37e4a67e
SHA256

d1ec88f75d1134f2df67601950a89d727579cadcd69c34a53ab11847aee99e0e
SHA512

bb79e93682bd4ab03b5fc38b68a257a5ba2ad04eaeda84c64663525724b3caf19268c37d320bf2e963354e1cca3e791643d0b729fe7ae034724b248effc4308e

Score

10^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

EXCEL.EXEexplorer.exe

description	pid	process	target process
PID 240 wrote to memory of 364	240	EXCEL.EXE	explorer.exe
PID 240 wrote to memory of 364	240	EXCEL.EXE	explorer.exe
PID 240 wrote to memory of 364	240	EXCEL.EXE	explorer.exe
PID 1048 wrote to memory of 1500	1048	explorer.exe	WScript.exe
PID 1048 wrote to memory of 1500	1048	explorer.exe	WScript.exe
PID 1048 wrote to memory of 1500	1048	explorer.exe	WScript.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

240 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

240 EXCEL.EXE
240 EXCEL.EXE
240 EXCEL.EXE

pid	process
240	EXCEL.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	364	240	explorer.exe	EXCEL.EXE

C:\Windows\explorer.exe
explorer.exe C:\Users\Admin\AppData\Local\Temp\LbMba.vbs
2⤵
- Process spawned unexpected child process
PID:364

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\LbMba.vbs"
2⤵
PID:1500

C:\Users\Admin\AppData\Local\Temp\LbMba.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\dDxd.txt

Download Submit
memory/240-0-0x0000000006AD0000-0x0000000006AD1000-memory.dmp

Filesize
4KB

Download
memory/240-6-0x0000000005AC0000-0x0000000005AC8000-memory.dmp

Filesize
32KB

Download
memory/364-1-0x0000000000000000-mapping.dmp

Download
memory/1500-3-0x0000000000000000-mapping.dmp

Download
memory/1500-4-0x0000000002630000-0x0000000002634000-memory.dmp

Filesize
16KB

Download