3f56eaa38eace04eaaee759ab6d855ef9555f66d472106099a42ab31c3f746ec

Analysis

max time kernel
130s
max time network
136s
platform
windows7_x64
resource
win7
submitted
10-07-2020 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file_124672.xls
Size

295KB
MD5

393ded3846127150dc6b7dbd2dc32082
SHA1

a2b57df48dd77bbd46718ad9d4bc82fc710984aa
SHA256

3f56eaa38eace04eaaee759ab6d855ef9555f66d472106099a42ab31c3f746ec
SHA512

e014c290ea859e204f877e67e0bc59e0f065b7515b4655cb3b9708095467cfb14a95dcc36872acf09bf92c8d21f5874b842b10ec4986dac8ca4ba1db3ebb3012

Score

6^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1164 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1164 EXCEL.EXE
1164 EXCEL.EXE
1164 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

EXCEL.EXE

pid process

1164 EXCEL.EXE

pid	process
1164	EXCEL.EXE

pid	process
1164	EXCEL.EXE
1164	EXCEL.EXE
1164	EXCEL.EXE

pid	process
1164	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

Processes:

DW20.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1468	1164	DW20.EXE	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

EXCEL.EXEDW20.EXE

description	pid	process	target process
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	DW20.EXE
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	DW20.EXE
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	DW20.EXE
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	DW20.EXE
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	DW20.EXE
PID 1468 wrote to memory of 1508	1468	DW20.EXE	dwwin.exe
PID 1468 wrote to memory of 1508	1468	DW20.EXE	dwwin.exe
PID 1468 wrote to memory of 1508	1468	DW20.EXE	dwwin.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dwwin.exe

pid process

1508 dwwin.exe

pid	process
1508	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\file_124672.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1164
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1176
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1176
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\68624.cvr

Download Submit
memory/1468-0-0x0000000000000000-mapping.dmp

Download
memory/1508-1-0x0000000000000000-mapping.dmp

Download
memory/1508-2-0x0000000001D80000-0x0000000001D91000-memory.dmp

Filesize
68KB

Download
memory/1508-4-0x00000000022D0000-0x00000000022E1000-memory.dmp

Filesize
68KB

Download