SOC138 EventID:77 - Detected Suspicious Xls File
Analysis of suspicious file
Figure 1 Screenshot of the alert
Dynamic Malware Analysis
Analyzing the behavior of malware on a Windows VM.
To began the malware analysis, monitoring tools such as Process hacker are opened before executing the suspicious programs. Process hacker allows us to see the process activities. When the the malware is initiated, we should expect to see it under the explorer.exe process.