3f56eaa38eace04eaaee759ab6d855ef9555f66d472106099a42ab31c3f746ec

Analysis

max time kernel
130s
max time network
136s
platform
windows7_x64
resource
win7
submitted
10/07/2020, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file_124672.xls
Size 295KB
Sample200710-3jrrtggf9e
SHA256 3f56eaa38eace04eaaee759ab6d855ef9555f66d472106099a42ab31c3f746ec
MD5 393ded3846127150dc6b7dbd2dc32082
SHA1 a2b57df48dd77bbd46718ad9d4bc82fc710984aa
SHA512 e014c290ea859e204f877e67e0bc59e0f065b7515b4655cb3b9708095467cfb14a95dcc36872acf09bf92c8d21f5874b842b10ec4986dac8ca4ba1db3ebb3012
MD5 SHA1 SHA512

Score

6^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1164	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1164	EXCEL.EXE
1164	EXCEL.EXE
1164	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1164	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1468	1164	DW20.EXE	23

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	24
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	24
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	24
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	24
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	24
PID 1468 wrote to memory of 1508	1468	DW20.EXE	25
PID 1468 wrote to memory of 1508	1468	DW20.EXE	25
PID 1468 wrote to memory of 1508	1468	DW20.EXE	25

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1508	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\file_124672.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1164
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1176
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1176
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-2-0x0000000001D80000-0x0000000001D91000-memory.dmp

Download

memory/1508-4-0x00000000022D0000-0x00000000022E1000-memory.dmp

Download