Analysis
-
max time kernel
108s -
max time network
115s -
platform
windows7_x64 -
resource
win7v200410 -
submitted
23-04-2020 14:16
Static task
static1
Behavioral task
behavioral1
Sample
49ed0e7aed118c46daed37f7d0eb62ab111cf6f9ab295b4b165ce82585539908.xls
Resource
win7v200410
General
-
Target
49ed0e7aed118c46daed37f7d0eb62ab111cf6f9ab295b4b165ce82585539908.xls
-
Size
76KB
-
MD5
228003634e57d37f08787be02c0b6c14
-
SHA1
0e71bb6f250012609c08adf74d1cec6587b6cc05
-
SHA256
49ed0e7aed118c46daed37f7d0eb62ab111cf6f9ab295b4b165ce82585539908
-
SHA512
5adcc817a196ef0cfc176d089564d8d87528e0a69134287b8858907a8e97040bdbc05b0b5d87db9a9856e641673c27effc3bed5f70754e87dbbef0d64dfa1375
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1600 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
EXCEL.EXEpid process 1600 EXCEL.EXE 1600 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1700 1600 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 1600 wrote to memory of 1700 1600 EXCEL.EXE DW20.EXE PID 1600 wrote to memory of 1700 1600 EXCEL.EXE DW20.EXE PID 1600 wrote to memory of 1700 1600 EXCEL.EXE DW20.EXE PID 1600 wrote to memory of 1700 1600 EXCEL.EXE DW20.EXE PID 1600 wrote to memory of 1700 1600 EXCEL.EXE DW20.EXE PID 1700 wrote to memory of 1692 1700 DW20.EXE dwwin.exe PID 1700 wrote to memory of 1692 1700 DW20.EXE dwwin.exe PID 1700 wrote to memory of 1692 1700 DW20.EXE dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\49ed0e7aed118c46daed37f7d0eb62ab111cf6f9ab295b4b165ce82585539908.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11522⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11523⤵