Analysis
-
max time kernel
105s -
max time network
57s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 19:00
Static task
static1
Behavioral task
behavioral1
Sample
account_invoice_5918.xls
Resource
win7v200430
Behavioral task
behavioral2
Sample
account_invoice_5918.xls
Resource
win10
General
-
Target
account_invoice_5918.xls
-
Size
166KB
-
MD5
a13b46e0c9153d4ce366ad65c4d2fc04
-
SHA1
bd1c268034ab18a61ef5bb2f4c75de70fd739124
-
SHA256
56754abf3731d99b740618119f73736894c6aba81fde45ee27f864f10b376341
-
SHA512
54cfc04fe000011ea8ecc12988dfa9b4f572093d187a5bc3473333ae142990130165bbf71a5b1751ab454f40535eb2d8ce01d642cffb5f22646b79411fb5a40f
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1296 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1296 EXCEL.EXE 1296 EXCEL.EXE 1296 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 1296 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1412 1296 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 1296 wrote to memory of 1412 1296 EXCEL.EXE DW20.EXE PID 1296 wrote to memory of 1412 1296 EXCEL.EXE DW20.EXE PID 1296 wrote to memory of 1412 1296 EXCEL.EXE DW20.EXE PID 1296 wrote to memory of 1412 1296 EXCEL.EXE DW20.EXE PID 1296 wrote to memory of 1412 1296 EXCEL.EXE DW20.EXE PID 1412 wrote to memory of 1520 1412 DW20.EXE dwwin.exe PID 1412 wrote to memory of 1520 1412 DW20.EXE dwwin.exe PID 1412 wrote to memory of 1520 1412 DW20.EXE dwwin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 1520 dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\account_invoice_5918.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11602⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11603⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\99528.cvr
-
memory/1412-0-0x0000000000000000-mapping.dmp
-
memory/1520-1-0x0000000000000000-mapping.dmp
-
memory/1520-2-0x0000000001EE0000-0x0000000001EF1000-memory.dmpFilesize
68KB
-
memory/1520-4-0x00000000022B0000-0x00000000022C1000-memory.dmpFilesize
68KB