Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
08-08-2023 18:06
Static task
static1
Behavioral task
behavioral1
Sample
Copy of VALUE STREAM MAPPING (MACROS).xlsm
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Copy of VALUE STREAM MAPPING (MACROS).xlsm
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Copy of VALUE STREAM MAPPING (MACROS).xlsm
-
Size
159KB
-
MD5
02a822b178d00c485e368f18df24d777
-
SHA1
efac62e7b32d0b9f762a1942d50e76854b7b8db7
-
SHA256
ab2d5ede7bc314245972ffdaa7b7b4f1ee3c8dbffefe9b62a814ef1a6902b7c5
-
SHA512
822108f16584c325fe5d9714128f5e5059e54649e76064dce0c4261a85bc7b8d2f25e4ecf86cf9928da90d38ae22b56ee207cca19d694e1462f4483f6cb3e1a7
-
SSDEEP
3072:s1DejTscanBTnumDw8fvEgaNYzc5N67IEDua4qizrFnxVeIIBNf14naLXe4PV:eejtaBP9Y3s7IAuzqiHFxEIID/LXf9
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2412 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2412 EXCEL.EXE 2412 EXCEL.EXE 2412 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2928 2412 EXCEL.EXE 28 PID 2412 wrote to memory of 2928 2412 EXCEL.EXE 28 PID 2412 wrote to memory of 2928 2412 EXCEL.EXE 28 PID 2412 wrote to memory of 2928 2412 EXCEL.EXE 28
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Copy of VALUE STREAM MAPPING (MACROS).xlsm"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2928
-