277d042525c05436f089a9d6ebbb0f9d865c07719f83015124b38e14917b701c

Analysis

max time kernel
113s
max time network
119s
platform
windows7_x64
resource
win7
submitted
13/07/2020, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
277d042525c05436f089a9d6ebbb0f9d865c07719f83015124b38e14917b701c.xls
Size 334KB
Sample200713-lrxb42lpge
SHA256 277d042525c05436f089a9d6ebbb0f9d865c07719f83015124b38e14917b701c
MD5 22a6aeda0dc21144a8fbe951b3867caf
SHA1 830de311f28be27a6ee05022ad32a5d7ea407b4b
SHA512 55d9fddd6560ddbbd31471ef1519a8e5c17dba11501fa3ab95ed0c784d3ac1210501b7db9c954c47d5120983e61be0da685e4ae5e46916a47d83cab953ab1649
MD5 SHA1 SHA512

Score

6^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1516	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1516	EXCEL.EXE
1516	EXCEL.EXE
1516	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1516	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1752	1516	DW20.EXE	23

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1752	1516	EXCEL.EXE	24
PID 1516 wrote to memory of 1752	1516	EXCEL.EXE	24
PID 1516 wrote to memory of 1752	1516	EXCEL.EXE	24
PID 1516 wrote to memory of 1752	1516	EXCEL.EXE	24
PID 1516 wrote to memory of 1752	1516	EXCEL.EXE	24
PID 1752 wrote to memory of 1856	1752	DW20.EXE	25
PID 1752 wrote to memory of 1856	1752	DW20.EXE	25
PID 1752 wrote to memory of 1856	1752	DW20.EXE	25

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1856	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\277d042525c05436f089a9d6ebbb0f9d865c07719f83015124b38e14917b701c.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1516
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1164
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1164
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-2-0x0000000001E10000-0x0000000001E21000-memory.dmp

Download

memory/1856-4-0x0000000002260000-0x0000000002271000-memory.dmp

Download