Analysis
-
max time kernel
103s -
max time network
68s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 05:36
Static task
static1
Behavioral task
behavioral1
Sample
IRS_form_7559663.xls
Resource
win7
Behavioral task
behavioral2
Sample
IRS_form_7559663.xls
Resource
win10v200430
General
-
Target
IRS_form_7559663.xls
-
Size
78KB
-
MD5
9dad374d4a2553733ebf424e3fde48e4
-
SHA1
905ceab79cf08d1e66293e77fc0c7bbf9326ac69
-
SHA256
53443315360c434457eca1626003a288924a363677a4e1ca1bbaad902f677674
-
SHA512
8219a9cf5a80370aa30609e48f580a956874080205ee50102416e6ac8c1c27d62119dcd2e4d10edd507b890fe4a0dfe2cadfedc702fdafe379f206343ad5dbf4
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 1076 dwwin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 284 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 284 EXCEL.EXE 284 EXCEL.EXE 284 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 284 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1100 284 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 284 wrote to memory of 1100 284 EXCEL.EXE DW20.EXE PID 284 wrote to memory of 1100 284 EXCEL.EXE DW20.EXE PID 284 wrote to memory of 1100 284 EXCEL.EXE DW20.EXE PID 284 wrote to memory of 1100 284 EXCEL.EXE DW20.EXE PID 284 wrote to memory of 1100 284 EXCEL.EXE DW20.EXE PID 1100 wrote to memory of 1076 1100 DW20.EXE dwwin.exe PID 1100 wrote to memory of 1076 1100 DW20.EXE dwwin.exe PID 1100 wrote to memory of 1076 1100 DW20.EXE dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\IRS_form_7559663.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:284 -
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11682⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11683⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1076