Analysis
-
max time kernel
103s -
max time network
39s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 05:42
Static task
static1
Behavioral task
behavioral1
Sample
IRS_form_3690735.xls
Resource
win7
Behavioral task
behavioral2
Sample
IRS_form_3690735.xls
Resource
win10v200430
General
-
Target
IRS_form_3690735.xls
-
Size
78KB
-
MD5
85d0e857f338ce777927f0e3fda149d5
-
SHA1
88d866392071f68237bbf46110c9d20f5c5eb9f7
-
SHA256
7e3638d120694383935bb8b66f6e20fd9cfb2902d7865a4d8eb6d751175579ba
-
SHA512
74b5c8c8dbf7eef921da24e95059a13a0944e8f8df1429e0734b6fb9bc179890c5c197d5a31fbe379183917da04f986718c41c4b5db9cb8c65fe34a43a3d727f
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 616 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 616 EXCEL.EXE 616 EXCEL.EXE 616 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 616 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1556 616 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 616 wrote to memory of 1556 616 EXCEL.EXE DW20.EXE PID 616 wrote to memory of 1556 616 EXCEL.EXE DW20.EXE PID 616 wrote to memory of 1556 616 EXCEL.EXE DW20.EXE PID 616 wrote to memory of 1556 616 EXCEL.EXE DW20.EXE PID 616 wrote to memory of 1556 616 EXCEL.EXE DW20.EXE PID 1556 wrote to memory of 864 1556 DW20.EXE dwwin.exe PID 1556 wrote to memory of 864 1556 DW20.EXE dwwin.exe PID 1556 wrote to memory of 864 1556 DW20.EXE dwwin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 864 dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\IRS_form_3690735.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11642⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11643⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\66706.cvr
-
memory/864-1-0x0000000000000000-mapping.dmp
-
memory/864-2-0x0000000001E70000-0x0000000001E81000-memory.dmpFilesize
68KB
-
memory/864-4-0x00000000023C0000-0x00000000023D1000-memory.dmpFilesize
68KB
-
memory/1556-0-0x0000000000000000-mapping.dmp