f8fdedc7cf7723529ab1c59c87213bf958c073961682503cb8cf6666e939c9ac

Analysis

max time kernel
111s
max time network
120s
platform
windows7_x64
resource
win7
submitted
13-07-2020 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.DOC.Kryptik.Q.19218.xls
Size

294KB
MD5

840aba4646c5889e50c6ffe48f4b0306
SHA1

5e99091a36f48ef18dfedbd39afbc06475ed14fb
SHA256

f8fdedc7cf7723529ab1c59c87213bf958c073961682503cb8cf6666e939c9ac
SHA512

acdde93733172b94aee64adfe54ad898a4025331cf4e5a2c5c4bcbbd3bd5096063b228331cfd9520d4c4620629e3d36aa80ca72b545d77c3cdef3b54975d7ca3

Score

6^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1344	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1344	EXCEL.EXE
1344	EXCEL.EXE
1344	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1344	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1600	1344	DW20.EXE	23

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1600	1344	EXCEL.EXE	24
PID 1344 wrote to memory of 1600	1344	EXCEL.EXE	24
PID 1344 wrote to memory of 1600	1344	EXCEL.EXE	24
PID 1344 wrote to memory of 1600	1344	EXCEL.EXE	24
PID 1344 wrote to memory of 1600	1344	EXCEL.EXE	24
PID 1600 wrote to memory of 1000	1600	DW20.EXE	25
PID 1600 wrote to memory of 1000	1600	DW20.EXE	25
PID 1600 wrote to memory of 1000	1600	DW20.EXE	25

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1000	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.DOC.Kryptik.Q.19218.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1344
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1172
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1172
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-2-0x0000000001E00000-0x0000000001E11000-memory.dmp

Filesize
68KB

Download
memory/1000-4-0x00000000022E0000-0x00000000022F1000-memory.dmp

Filesize
68KB

Download