b17553745e016653cace2242fbf6be5d91642e9ec2424d43f97d47576b2fc046

Analysis

max time kernel
112s
max time network
117s
platform
windows7_x64
resource
win7
submitted
13-07-2020 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QO-77190441.xlsm
Size

64KB
MD5

93897aa2998c1991834aa52bf86c0ad5
SHA1

b91d37f744db2606709ec999f8eeb97c7b4c0514
SHA256

b17553745e016653cace2242fbf6be5d91642e9ec2424d43f97d47576b2fc046
SHA512

b6d3f60776846c1a74be4ae9c1b9615de03ef5d52e3590477e0a4a292f4eecea3c4f2ff8a834e5019a1472a9fd00241209018a9d5214dc9b1cea7a186cdae061

Score

6^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1448 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1448 EXCEL.EXE
1448 EXCEL.EXE
1448 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

EXCEL.EXE

pid process

1448 EXCEL.EXE

pid	process
1448	EXCEL.EXE

pid	process
1448	EXCEL.EXE
1448	EXCEL.EXE
1448	EXCEL.EXE

pid	process
1448	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

Processes:

DW20.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	284	1448	DW20.EXE	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

EXCEL.EXEDW20.EXE

description	pid	process	target process
PID 1448 wrote to memory of 284	1448	EXCEL.EXE	DW20.EXE
PID 1448 wrote to memory of 284	1448	EXCEL.EXE	DW20.EXE
PID 1448 wrote to memory of 284	1448	EXCEL.EXE	DW20.EXE
PID 1448 wrote to memory of 284	1448	EXCEL.EXE	DW20.EXE
PID 1448 wrote to memory of 284	1448	EXCEL.EXE	DW20.EXE
PID 284 wrote to memory of 756	284	DW20.EXE	dwwin.exe
PID 284 wrote to memory of 756	284	DW20.EXE	dwwin.exe
PID 284 wrote to memory of 756	284	DW20.EXE	dwwin.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dwwin.exe

pid process

756 dwwin.exe

pid	process
756	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\QO-77190441.xlsm
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1448

C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1168
2⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:284

C:\Windows\system32\dwwin.exe
C:\Windows\system32\dwwin.exe -x -s 1168
3⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\68297.cvr

Download Submit
memory/284-0-0x0000000000000000-mapping.dmp

Download
memory/756-1-0x0000000000000000-mapping.dmp

Download
memory/756-2-0x0000000001C50000-0x0000000001C61000-memory.dmp

Filesize
68KB

Download
memory/756-4-0x0000000002200000-0x0000000002211000-memory.dmp

Filesize
68KB

Download