Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 19:22
Static task
static1
Behavioral task
behavioral1
Sample
Form_1099_5715537.xls
Resource
win7
0 signatures
0 seconds
General
-
Target
Form_1099_5715537.xls
-
Size
90KB
-
MD5
d1bda4049e740009dff39fe1698cb00a
-
SHA1
efc17b6d5cdd51832d90a71b7cfdea7248473d44
-
SHA256
2e0487c6cbecd68c83166ebf8742f9784be52dba4d77d37a359bacb33790cb76
-
SHA512
af682858aea2df8b9a94f97d630a4702c4c3fdb0e688f438b6495408efea3a352b6fc01427d27d17a0fe9f85c028f8ae6fa2a3653c63670c18f0ef865838db54
Score
6/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1612 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1612 EXCEL.EXE 1612 EXCEL.EXE 1612 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 1612 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1532 1612 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 1612 wrote to memory of 1532 1612 EXCEL.EXE DW20.EXE PID 1612 wrote to memory of 1532 1612 EXCEL.EXE DW20.EXE PID 1612 wrote to memory of 1532 1612 EXCEL.EXE DW20.EXE PID 1612 wrote to memory of 1532 1612 EXCEL.EXE DW20.EXE PID 1612 wrote to memory of 1532 1612 EXCEL.EXE DW20.EXE PID 1532 wrote to memory of 1692 1532 DW20.EXE dwwin.exe PID 1532 wrote to memory of 1692 1532 DW20.EXE dwwin.exe PID 1532 wrote to memory of 1692 1532 DW20.EXE dwwin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 1692 dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Form_1099_5715537.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11602⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11603⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\67345.cvr
-
memory/1532-0-0x0000000000000000-mapping.dmp
-
memory/1692-1-0x0000000000000000-mapping.dmp
-
memory/1692-2-0x0000000001DE0000-0x0000000001DF1000-memory.dmpFilesize
68KB
-
memory/1692-4-0x0000000002160000-0x0000000002171000-memory.dmpFilesize
68KB