27ba6b6b56747320708fc658ba659bc5d3f77545453ee879cfc6ae210636786c

Analysis

max time kernel
111s
max time network
6s
platform
windows7_x64
resource
win7v200430
submitted
12-05-2020 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

offer_05634.xlsm
Size

115KB
MD5

3e0bbe29e435b2a5bf66091b2bc4efcf
SHA1

af4abd629cf997d80e2a57a37c4fd6408097e324
SHA256

27ba6b6b56747320708fc658ba659bc5d3f77545453ee879cfc6ae210636786c
SHA512

1acd893cd2d57573221dec7ec553eb7f513902d34c8669c15469ec1ca5829d6524cc5c4623c9cf39e863d6203e83343ac1915d2ee24a6be0a2eafdfa353d5c4c

Score

6^/10

Malware Config

Signatures

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

Processes:

DW20.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1284	316	DW20.EXE	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

316 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

EXCEL.EXE

pid process

316 EXCEL.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dwwin.exe

pid process

1400 dwwin.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

316 EXCEL.EXE
316 EXCEL.EXE
316 EXCEL.EXE

pid	process
316	EXCEL.EXE

pid	process
316	EXCEL.EXE

pid	process
1400	dwwin.exe

pid	process
316	EXCEL.EXE
316	EXCEL.EXE
316	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

EXCEL.EXEDW20.EXE

description	pid	process	target process
PID 316 wrote to memory of 1284	316	EXCEL.EXE	DW20.EXE
PID 316 wrote to memory of 1284	316	EXCEL.EXE	DW20.EXE
PID 316 wrote to memory of 1284	316	EXCEL.EXE	DW20.EXE
PID 316 wrote to memory of 1284	316	EXCEL.EXE	DW20.EXE
PID 316 wrote to memory of 1284	316	EXCEL.EXE	DW20.EXE
PID 1284 wrote to memory of 1400	1284	DW20.EXE	dwwin.exe
PID 1284 wrote to memory of 1400	1284	DW20.EXE	dwwin.exe
PID 1284 wrote to memory of 1400	1284	DW20.EXE	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\offer_05634.xlsm
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1176
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1176
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\102414.cvr

MD5
069022acc43bc1cee64725cbf7f1a5c7

SHA1
f904c200fb290ee4b4bf4e4a23fb9a7040b15803

SHA256
369e2273f989400684bfd753959cb5ecd6817452ae7b7749a9bfb81eda7f50a0

SHA512
da056c1b48671777ed73c6ea3c6f73486d5d3f45a3292722aad21ad2811e95891836bac78a318467a709d8308ada4314d5b2c024f1bd0b10e7db966d6b9a900d

Download Submit
memory/1400-0-0x0000000001DC0000-0x0000000001DD1000-memory.dmp

Filesize
68KB

Download
memory/1400-2-0x00000000022B0000-0x00000000022C1000-memory.dmp

Filesize
68KB

Download