Resubmissions

10-04-2022 07:53

220410-jq25nsgaen 10

10-04-2020 08:18

200410-tmzpvazbjn 10

Analysis

  • max time kernel
    109s
  • max time network
    80s
  • platform
    windows7_x64
  • resource
    win7v200217
  • submitted
    10-04-2020 08:18

General

  • Target

    William Smith Resume.xls

  • Size

    163KB

  • MD5

    0a054818926d97f4100774255a908dba

  • SHA1

    de572eddd30b34d1e328c8d5fb986cc1e04c82e8

  • SHA256

    0fba1f02cd2872efc4cdc6806bc49d786005f590971ee31f97ce71c1ccf87fe2

  • SHA512

    21659d1132eef51aaf43f7c3dffde06e7018e7d9847c7a7106eb9aee2747f9c6a967a80ab052db17903b0ac9cb63ee3c8371725f4206decff13dbbe996bcf3f1

Score
6/10

Malware Config

Signatures

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\William Smith Resume.xls"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
      "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1164
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 1164
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\34835.cvr
  • memory/1900-0-0x0000000001DE0000-0x0000000001DF1000-memory.dmp
    Filesize

    68KB

  • memory/1900-2-0x0000000002300000-0x0000000002311000-memory.dmp
    Filesize

    68KB