27ba6b6b56747320708fc658ba659bc5d3f77545453ee879cfc6ae210636786c

Analysis

max time kernel
111s
max time network
6s
platform
windows7_x64
resource
win7v200430
submitted
12-05-2020 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

offer_05634.xlsm
Size

115KB
MD5

3e0bbe29e435b2a5bf66091b2bc4efcf
SHA1

af4abd629cf997d80e2a57a37c4fd6408097e324
SHA256

27ba6b6b56747320708fc658ba659bc5d3f77545453ee879cfc6ae210636786c
SHA512

1acd893cd2d57573221dec7ec553eb7f513902d34c8669c15469ec1ca5829d6524cc5c4623c9cf39e863d6203e83343ac1915d2ee24a6be0a2eafdfa353d5c4c

Score

6^/10

Malware Config

Signatures

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1284	316	DW20.EXE	23

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
316	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
316	EXCEL.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1400	dwwin.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
316	EXCEL.EXE
316	EXCEL.EXE
316	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 1284	316	EXCEL.EXE	24
PID 316 wrote to memory of 1284	316	EXCEL.EXE	24
PID 316 wrote to memory of 1284	316	EXCEL.EXE	24
PID 316 wrote to memory of 1284	316	EXCEL.EXE	24
PID 316 wrote to memory of 1284	316	EXCEL.EXE	24
PID 1284 wrote to memory of 1400	1284	DW20.EXE	25
PID 1284 wrote to memory of 1400	1284	DW20.EXE	25
PID 1284 wrote to memory of 1400	1284	DW20.EXE	25

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\offer_05634.xlsm
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1176
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1176
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-0-0x0000000001DC0000-0x0000000001DD1000-memory.dmp

Filesize
68KB

Download
memory/1400-2-0x00000000022B0000-0x00000000022C1000-memory.dmp

Filesize
68KB

Download