650eb12a21a9ab6b9a3063f366e59066f12040cad0ff5967b028d9c199abc955

Analysis

max time kernel
112s
max time network
118s
platform
windows7_x64
resource
win7
submitted
12/07/2020, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Loan_1428.xls
Size

231KB
MD5

400e6efd2c77e645e0dc39c2982ddf56
SHA1

5a4fb6824785616c9579c40a76ce0a899bcbe747
SHA256

650eb12a21a9ab6b9a3063f366e59066f12040cad0ff5967b028d9c199abc955
SHA512

1f1717a3a586fc6e6c7d5cc0cb66d72dffade0e851e16c79cdb8f84a78dbd507a8206e05c271c848f1674b93cfed56a19e6eca59b064d467c2a29f054eb50cfa

Score

6^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1164	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1164	EXCEL.EXE
1164	EXCEL.EXE
1164	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1164	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1468	1164	DW20.EXE	23

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	24
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	24
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	24
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	24
PID 1164 wrote to memory of 1468	1164	EXCEL.EXE	24
PID 1468 wrote to memory of 1508	1468	DW20.EXE	25
PID 1468 wrote to memory of 1508	1468	DW20.EXE	25
PID 1468 wrote to memory of 1508	1468	DW20.EXE	25

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1508	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Loan_1428.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1164
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1184
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1184
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-2-0x0000000001D50000-0x0000000001D61000-memory.dmp

Filesize
68KB

Download
memory/1508-4-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download