Analysis
-
max time kernel
62s -
max time network
38s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 06:26
Static task
static1
Behavioral task
behavioral1
Sample
order-649.xls
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
order-649.xls
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
order-649.xls
-
Size
148KB
-
MD5
0e08cfc72b49a23f004c5a944b69478f
-
SHA1
8f55d06882f10d0e2d1f42b020e836ae37e4a67e
-
SHA256
d1ec88f75d1134f2df67601950a89d727579cadcd69c34a53ab11847aee99e0e
-
SHA512
bb79e93682bd4ab03b5fc38b68a257a5ba2ad04eaeda84c64663525724b3caf19268c37d320bf2e963354e1cca3e791643d0b729fe7ae034724b248effc4308e
Score
10/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
EXCEL.EXEexplorer.exedescription pid process target process PID 240 wrote to memory of 364 240 EXCEL.EXE explorer.exe PID 240 wrote to memory of 364 240 EXCEL.EXE explorer.exe PID 240 wrote to memory of 364 240 EXCEL.EXE explorer.exe PID 1048 wrote to memory of 1500 1048 explorer.exe WScript.exe PID 1048 wrote to memory of 1500 1048 explorer.exe WScript.exe PID 1048 wrote to memory of 1500 1048 explorer.exe WScript.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 240 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 240 EXCEL.EXE 240 EXCEL.EXE 240 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 364 240 explorer.exe EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\order-649.xls1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\LbMba.vbs2⤵
- Process spawned unexpected child process
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\LbMba.vbs"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\LbMba.vbs
-
C:\Users\Admin\AppData\Local\Temp\dDxd.txt
-
memory/240-0-0x0000000006AD0000-0x0000000006AD1000-memory.dmpFilesize
4KB
-
memory/240-6-0x0000000005AC0000-0x0000000005AC8000-memory.dmpFilesize
32KB
-
memory/364-1-0x0000000000000000-mapping.dmp
-
memory/1500-3-0x0000000000000000-mapping.dmp
-
memory/1500-4-0x0000000002630000-0x0000000002634000-memory.dmpFilesize
16KB