Analysis
-
max time kernel
112s -
max time network
119s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 20:00
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.DOC.Kryptik.Q.19959.xls
Resource
win7
Behavioral task
behavioral2
Sample
SecuriteInfo.com.DOC.Kryptik.Q.19959.xls
Resource
win10v200430
General
-
Target
SecuriteInfo.com.DOC.Kryptik.Q.19959.xls
-
Size
300KB
-
MD5
0f36cda529d843ef743d017c0552d49c
-
SHA1
3437325cae5a1b06c2660d31301d8ef58aafc13e
-
SHA256
2da1972125f1c6719ae58db97e2cf56e73d69b3885ef8aa437c4118d85023edf
-
SHA512
9019e1f8d20f665314cc8011d36a4e8e8b43c6881557eba487ee557a48c861e53b31430efd25f4220b837801cea702214d03b6483d4654209577b5cac1e43d2d
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 1124 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1436 1124 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 1124 wrote to memory of 1436 1124 EXCEL.EXE DW20.EXE PID 1124 wrote to memory of 1436 1124 EXCEL.EXE DW20.EXE PID 1124 wrote to memory of 1436 1124 EXCEL.EXE DW20.EXE PID 1124 wrote to memory of 1436 1124 EXCEL.EXE DW20.EXE PID 1124 wrote to memory of 1436 1124 EXCEL.EXE DW20.EXE PID 1436 wrote to memory of 1476 1436 DW20.EXE dwwin.exe PID 1436 wrote to memory of 1476 1436 DW20.EXE dwwin.exe PID 1436 wrote to memory of 1476 1436 DW20.EXE dwwin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 1476 dwwin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1124 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1124 EXCEL.EXE 1124 EXCEL.EXE 1124 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.DOC.Kryptik.Q.19959.xls1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1124 -
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11762⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11763⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1476