47eafba484079fa8aa5d24fbc4b7cca836f3695b9276770f48b0d134041d3f5e

Analysis

max time kernel
115s
max time network
120s
platform
windows7_x64
resource
win7
submitted
13/07/2020, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

47eafba484079fa8aa5d24fbc4b7cca836f3695b9276770f48b0d134041d3f5e.xls
Size

338KB
MD5

19f638b99815a1e1862ad2c36448eb31
SHA1

d2314e3f0a5a476b4dc479f6f5cc8a5fb3ea95c2
SHA256

47eafba484079fa8aa5d24fbc4b7cca836f3695b9276770f48b0d134041d3f5e
SHA512

3a26a1b59f47b7a1dade35fd1cbd748ec49810c1cd418207f12e0bd0eae0de8d8478a68fb7e1378009d77b6e85c356d3fee4092d50f6ce60e720141d877fd554

Score

6^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
608	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
608	EXCEL.EXE
608	EXCEL.EXE
608	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
608	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1556	608	DW20.EXE	23

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 1556	608	EXCEL.EXE	24
PID 608 wrote to memory of 1556	608	EXCEL.EXE	24
PID 608 wrote to memory of 1556	608	EXCEL.EXE	24
PID 608 wrote to memory of 1556	608	EXCEL.EXE	24
PID 608 wrote to memory of 1556	608	EXCEL.EXE	24
PID 1556 wrote to memory of 452	1556	DW20.EXE	25
PID 1556 wrote to memory of 452	1556	DW20.EXE	25
PID 1556 wrote to memory of 452	1556	DW20.EXE	25

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
452	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\47eafba484079fa8aa5d24fbc4b7cca836f3695b9276770f48b0d134041d3f5e.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:608
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1144
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1144
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/452-2-0x0000000001D40000-0x0000000001D51000-memory.dmp

Filesize
68KB

Download
memory/452-4-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download