94de9339ec227a42e376a827db37564436f084e8efcca15530242d88c58e0c27

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7
submitted
08-07-2020 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e24db78c4d4fda4b221a7d553c6f20e6.xls
Size

697KB
MD5

e24db78c4d4fda4b221a7d553c6f20e6
SHA1

e41f581df80cf5ccdcd0c7019d0d03ab6e5c6bb3
SHA256

94de9339ec227a42e376a827db37564436f084e8efcca15530242d88c58e0c27
SHA512

1c705357db51516c28392a23c22e97cc90f0ad1511601218632069422e20e55cb5c90bec20e2bf5326978c3cc8769aabc935e5cdcbf201ed66207b18856df89a

Score

6^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1296	2040	EXCEL.EXE	24
PID 2040 wrote to memory of 1296	2040	EXCEL.EXE	24
PID 2040 wrote to memory of 1296	2040	EXCEL.EXE	24
PID 2040 wrote to memory of 1296	2040	EXCEL.EXE	24
PID 2040 wrote to memory of 1296	2040	EXCEL.EXE	24
PID 1296 wrote to memory of 1412	1296	DW20.EXE	25
PID 1296 wrote to memory of 1412	1296	DW20.EXE	25
PID 1296 wrote to memory of 1412	1296	DW20.EXE	25

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1412	dwwin.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2040	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2040	EXCEL.EXE
2040	EXCEL.EXE
2040	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2040	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1296	2040	DW20.EXE	23

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\e24db78c4d4fda4b221a7d553c6f20e6.xls
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
PID:2040
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1156
  2⤵
  - Suspicious use of WriteProcessMemory
  - Process spawned suspicious child process
  PID:1296
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1156
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1412-2-0x0000000001DC0000-0x0000000001DD1000-memory.dmp

Filesize
68KB

Download
memory/1412-4-0x0000000002230000-0x0000000002241000-memory.dmp

Filesize
68KB

Download