Analysis

  • max time kernel
    111s
  • max time network
    6s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    12-05-2020 18:52

General

  • Target

    offer_05634.xlsm

  • Size

    115KB

  • MD5

    3e0bbe29e435b2a5bf66091b2bc4efcf

  • SHA1

    af4abd629cf997d80e2a57a37c4fd6408097e324

  • SHA256

    27ba6b6b56747320708fc658ba659bc5d3f77545453ee879cfc6ae210636786c

  • SHA512

    1acd893cd2d57573221dec7ec553eb7f513902d34c8669c15469ec1ca5829d6524cc5c4623c9cf39e863d6203e83343ac1915d2ee24a6be0a2eafdfa353d5c4c

Score
6/10

Malware Config

Signatures

  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\offer_05634.xlsm
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:316
    • C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
      "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1176
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:1284
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 1176
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\102414.cvr
    MD5

    069022acc43bc1cee64725cbf7f1a5c7

    SHA1

    f904c200fb290ee4b4bf4e4a23fb9a7040b15803

    SHA256

    369e2273f989400684bfd753959cb5ecd6817452ae7b7749a9bfb81eda7f50a0

    SHA512

    da056c1b48671777ed73c6ea3c6f73486d5d3f45a3292722aad21ad2811e95891836bac78a318467a709d8308ada4314d5b2c024f1bd0b10e7db966d6b9a900d

  • memory/1400-0-0x0000000001DC0000-0x0000000001DD1000-memory.dmp
    Filesize

    68KB

  • memory/1400-2-0x00000000022B0000-0x00000000022C1000-memory.dmp
    Filesize

    68KB