Analysis
-
max time kernel
61s -
max time network
67s -
platform
windows10_x64 -
resource
win10 -
submitted
08-07-2020 05:39
Static task
static1
Behavioral task
behavioral1
Sample
Form_1099_1793465.xls
Resource
win7v200430
Behavioral task
behavioral2
Sample
Form_1099_1793465.xls
Resource
win10
General
-
Target
Form_1099_1793465.xls
-
Size
78KB
-
MD5
ea758830f5d03ac75190267289d4971a
-
SHA1
de0c22735fe3f82d8d05bc8249c968638cd6c6b1
-
SHA256
2b354d7dccd32f56af516f35821d9d389271da55cd4c9c7a97f30303d1136e04
-
SHA512
fcf8704d595ec636730a2849bd3f417250677c92b6bb777c6b019f53bdb093225e45d80b363cb4d7af6a6a93962fa874afb906db175fb4591993fbcdc1f104c2
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3536 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
EXCEL.EXEdwwin.exepid process 3536 EXCEL.EXE 3536 EXCEL.EXE 1664 dwwin.exe 1664 dwwin.exe -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3376 3536 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 3536 wrote to memory of 3376 3536 EXCEL.EXE DW20.EXE PID 3536 wrote to memory of 3376 3536 EXCEL.EXE DW20.EXE PID 3376 wrote to memory of 1664 3376 DW20.EXE dwwin.exe PID 3376 wrote to memory of 1664 3376 DW20.EXE dwwin.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Form_1099_1793465.xls"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 41802⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 41803⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1664-1-0x0000000000000000-mapping.dmp
-
memory/1664-2-0x0000014AAA110000-0x0000014AAA111000-memory.dmpFilesize
4KB
-
memory/1664-3-0x0000014AAA110000-0x0000014AAA111000-memory.dmpFilesize
4KB
-
memory/1664-5-0x0000014AAA870000-0x0000014AAA871000-memory.dmpFilesize
4KB
-
memory/1664-8-0x0000014AAAB60000-0x0000014AAAB61000-memory.dmpFilesize
4KB
-
memory/1664-9-0x0000014AAAB60000-0x0000014AAAB61000-memory.dmpFilesize
4KB
-
memory/1664-10-0x0000014AAAB60000-0x0000014AAAB61000-memory.dmpFilesize
4KB
-
memory/3376-0-0x0000000000000000-mapping.dmp