Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
10-07-2020 06:26
Static task
static1
Behavioral task
behavioral1
Sample
order-649.xls
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
order-649.xls
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
order-649.xls
-
Size
148KB
-
MD5
0e08cfc72b49a23f004c5a944b69478f
-
SHA1
8f55d06882f10d0e2d1f42b020e836ae37e4a67e
-
SHA256
d1ec88f75d1134f2df67601950a89d727579cadcd69c34a53ab11847aee99e0e
-
SHA512
bb79e93682bd4ab03b5fc38b68a257a5ba2ad04eaeda84c64663525724b3caf19268c37d320bf2e963354e1cca3e791643d0b729fe7ae034724b248effc4308e
Score
10/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings explorer.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 1616 EXCEL.EXE 1616 EXCEL.EXE 1616 EXCEL.EXE 1616 EXCEL.EXE 1616 EXCEL.EXE 1616 EXCEL.EXE 1616 EXCEL.EXE 1616 EXCEL.EXE 1616 EXCEL.EXE 1616 EXCEL.EXE 1616 EXCEL.EXE 1616 EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1616 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3884 1616 explorer.exe EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEexplorer.exedescription pid process target process PID 1616 wrote to memory of 3884 1616 EXCEL.EXE explorer.exe PID 1616 wrote to memory of 3884 1616 EXCEL.EXE explorer.exe PID 2040 wrote to memory of 3000 2040 explorer.exe WScript.exe PID 2040 wrote to memory of 3000 2040 explorer.exe WScript.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\order-649.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\LbMba.vbs2⤵
- Process spawned unexpected child process
PID:3884
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\LbMba.vbs"2⤵PID:3000