Analysis
-
max time kernel
103s -
max time network
67s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 07:36
Static task
static1
Behavioral task
behavioral1
Sample
43523-43523.xls
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
43523-43523.xls
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
43523-43523.xls
-
Size
724KB
-
MD5
6ef184c418172882f66daef47ea15b88
-
SHA1
e4fa1fb90ea55557698b21cf6e01c6d1e65d1777
-
SHA256
d32ce0fdda996a53b57658bfd55c4a44c8635276dc8e340657f887503c65cdf3
-
SHA512
50f9ac10a2066ddc47bbdb471b57fd07a32f08f501642acb747315dcca19222768afb3261f485d43e2b5b95caa5281ea2d270b2e0d9e0ec68c61ab62959ea00f
Score
6/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 112 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 112 EXCEL.EXE 112 EXCEL.EXE 112 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 112 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1068 112 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 112 wrote to memory of 1068 112 EXCEL.EXE DW20.EXE PID 112 wrote to memory of 1068 112 EXCEL.EXE DW20.EXE PID 112 wrote to memory of 1068 112 EXCEL.EXE DW20.EXE PID 112 wrote to memory of 1068 112 EXCEL.EXE DW20.EXE PID 112 wrote to memory of 1068 112 EXCEL.EXE DW20.EXE PID 1068 wrote to memory of 1652 1068 DW20.EXE dwwin.exe PID 1068 wrote to memory of 1652 1068 DW20.EXE dwwin.exe PID 1068 wrote to memory of 1652 1068 DW20.EXE dwwin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 1652 dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\43523-43523.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:112 -
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11882⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11883⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1652