b17553745e016653cace2242fbf6be5d91642e9ec2424d43f97d47576b2fc046

Analysis

max time kernel
112s
max time network
117s
platform
windows7_x64
resource
win7
submitted
13-07-2020 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QO-77190441.xlsm
Size

64KB
MD5

93897aa2998c1991834aa52bf86c0ad5
SHA1

b91d37f744db2606709ec999f8eeb97c7b4c0514
SHA256

b17553745e016653cace2242fbf6be5d91642e9ec2424d43f97d47576b2fc046
SHA512

b6d3f60776846c1a74be4ae9c1b9615de03ef5d52e3590477e0a4a292f4eecea3c4f2ff8a834e5019a1472a9fd00241209018a9d5214dc9b1cea7a186cdae061

Score

6^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1448	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1448	EXCEL.EXE
1448	EXCEL.EXE
1448	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1448	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	284	1448	DW20.EXE	23

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 284	1448	EXCEL.EXE	24
PID 1448 wrote to memory of 284	1448	EXCEL.EXE	24
PID 1448 wrote to memory of 284	1448	EXCEL.EXE	24
PID 1448 wrote to memory of 284	1448	EXCEL.EXE	24
PID 1448 wrote to memory of 284	1448	EXCEL.EXE	24
PID 284 wrote to memory of 756	284	DW20.EXE	25
PID 284 wrote to memory of 756	284	DW20.EXE	25
PID 284 wrote to memory of 756	284	DW20.EXE	25

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
756	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\QO-77190441.xlsm
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1448
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1168
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:284
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1168
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-2-0x0000000001C50000-0x0000000001C61000-memory.dmp

Filesize
68KB

Download
memory/756-4-0x0000000002200000-0x0000000002211000-memory.dmp

Filesize
68KB

Download