Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7 -
submitted
12-07-2020 11:24
Static task
static1
Behavioral task
behavioral1
Sample
17566-17566.xls
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
17566-17566.xls
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
17566-17566.xls
-
Size
736KB
-
MD5
8074ac3927dfb130c1fb20d7b248a339
-
SHA1
76983644278ba4979fca636ea89bd0076e64c146
-
SHA256
c93dd3f4f5789f893339c8fb5d1ccf64f5ad56a7740c311be0fd43193e361c96
-
SHA512
b38e9f0a63c24e577e79250d17de1302f758f2b95244b9b47e8dbb2829d134559d0e2c86f4981ad3172a99ede510a9ae85a02509887306c3711fa4d12274a22d
Score
6/10
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 1076 dwwin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 284 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 284 EXCEL.EXE 284 EXCEL.EXE 284 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 284 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1100 284 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 284 wrote to memory of 1100 284 EXCEL.EXE DW20.EXE PID 284 wrote to memory of 1100 284 EXCEL.EXE DW20.EXE PID 284 wrote to memory of 1100 284 EXCEL.EXE DW20.EXE PID 284 wrote to memory of 1100 284 EXCEL.EXE DW20.EXE PID 284 wrote to memory of 1100 284 EXCEL.EXE DW20.EXE PID 1100 wrote to memory of 1076 1100 DW20.EXE dwwin.exe PID 1100 wrote to memory of 1076 1100 DW20.EXE dwwin.exe PID 1100 wrote to memory of 1076 1100 DW20.EXE dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\17566-17566.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11802⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11803⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\71027.cvr
-
memory/1076-1-0x0000000000000000-mapping.dmp
-
memory/1076-2-0x0000000001E70000-0x0000000001E81000-memory.dmpFilesize
68KB
-
memory/1076-4-0x0000000002330000-0x0000000002341000-memory.dmpFilesize
68KB
-
memory/1100-0-0x0000000000000000-mapping.dmp