Analysis
-
max time kernel
151s -
max time network
56s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08-07-2020 05:39
Static task
static1
Behavioral task
behavioral1
Sample
Form_1099_1793465.xls
Resource
win7v200430
Behavioral task
behavioral2
Sample
Form_1099_1793465.xls
Resource
win10
General
-
Target
Form_1099_1793465.xls
-
Size
78KB
-
MD5
ea758830f5d03ac75190267289d4971a
-
SHA1
de0c22735fe3f82d8d05bc8249c968638cd6c6b1
-
SHA256
2b354d7dccd32f56af516f35821d9d389271da55cd4c9c7a97f30303d1136e04
-
SHA512
fcf8704d595ec636730a2849bd3f417250677c92b6bb777c6b019f53bdb093225e45d80b363cb4d7af6a6a93962fa874afb906db175fb4591993fbcdc1f104c2
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 1520 dwwin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1296 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1296 EXCEL.EXE 1296 EXCEL.EXE 1296 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 1296 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1412 1296 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 1296 wrote to memory of 1412 1296 EXCEL.EXE DW20.EXE PID 1296 wrote to memory of 1412 1296 EXCEL.EXE DW20.EXE PID 1296 wrote to memory of 1412 1296 EXCEL.EXE DW20.EXE PID 1296 wrote to memory of 1412 1296 EXCEL.EXE DW20.EXE PID 1296 wrote to memory of 1412 1296 EXCEL.EXE DW20.EXE PID 1412 wrote to memory of 1520 1412 DW20.EXE dwwin.exe PID 1412 wrote to memory of 1520 1412 DW20.EXE dwwin.exe PID 1412 wrote to memory of 1520 1412 DW20.EXE dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Form_1099_1793465.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11602⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11603⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\100807.cvr
-
memory/1412-0-0x0000000000000000-mapping.dmp
-
memory/1520-1-0x0000000000000000-mapping.dmp
-
memory/1520-2-0x0000000001E20000-0x0000000001E31000-memory.dmpFilesize
68KB
-
memory/1520-4-0x0000000002330000-0x0000000002341000-memory.dmpFilesize
68KB