Analysis
-
max time kernel
109s -
max time network
72s -
platform
windows7_x64 -
resource
win7v200217 -
submitted
02-04-2020 15:27
Static task
static1
Behavioral task
behavioral1
Sample
paul-176875.xls
Resource
win7v200217
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
paul-176875.xls
Resource
win10v200217
windows10_x64
0 signatures
0 seconds
General
-
Target
paul-176875.xls
-
Size
374KB
-
MD5
610ad5a9d4137f0d0f316dfe6aa648ed
-
SHA1
23fa7f0dea9cc43a7006c448c9a065f7b5494c35
-
SHA256
618feda769632fad7e77dd0c8ee8674f403a34488c5b4274294d2a8e5fb12849
-
SHA512
10fc071776d77dc34a62faa1b24307efc56eaf72e0204c905b9442479c293b490c3ecf4ec6102ca690de47f45b70480c642a143b20db2fe23ffa1996ee83f096
Score
6/10
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 1912 dwwin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1848 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1848 EXCEL.EXE 1848 EXCEL.EXE 1848 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 1848 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1904 1848 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 1848 wrote to memory of 1904 1848 EXCEL.EXE DW20.EXE PID 1848 wrote to memory of 1904 1848 EXCEL.EXE DW20.EXE PID 1848 wrote to memory of 1904 1848 EXCEL.EXE DW20.EXE PID 1848 wrote to memory of 1904 1848 EXCEL.EXE DW20.EXE PID 1848 wrote to memory of 1904 1848 EXCEL.EXE DW20.EXE PID 1904 wrote to memory of 1912 1904 DW20.EXE dwwin.exe PID 1904 wrote to memory of 1912 1904 DW20.EXE dwwin.exe PID 1904 wrote to memory of 1912 1904 DW20.EXE dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\paul-176875.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11642⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11643⤵
- Suspicious behavior: GetForegroundWindowSpam