Analysis
-
max time kernel
134s -
max time network
6s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-07-2020 20:00
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.DOC.Kryptik.Q.17206.xls
Resource
win7v200430
Behavioral task
behavioral2
Sample
SecuriteInfo.com.DOC.Kryptik.Q.17206.xls
Resource
win10
General
-
Target
SecuriteInfo.com.DOC.Kryptik.Q.17206.xls
-
Size
297KB
-
MD5
62e26facf7fccf4cd98fb2d8064bbda4
-
SHA1
6ca90193994b32e20f014b773e984be29cdb415f
-
SHA256
027e355c782feb5a0feec8d6fe004073e0d2f7d0d146fb81c3439f81e09d5aed
-
SHA512
aa7f178103bec3e3e2b8091e5a35fc00d68eb5809460fd7a785a1bddf0289d23ed603d82487e543df4a0e1435348f497f537e069574416f87b0416e5c208b4f6
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 1536 dwwin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1600 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 1600 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1036 1600 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 1600 wrote to memory of 1036 1600 EXCEL.EXE DW20.EXE PID 1600 wrote to memory of 1036 1600 EXCEL.EXE DW20.EXE PID 1600 wrote to memory of 1036 1600 EXCEL.EXE DW20.EXE PID 1600 wrote to memory of 1036 1600 EXCEL.EXE DW20.EXE PID 1600 wrote to memory of 1036 1600 EXCEL.EXE DW20.EXE PID 1036 wrote to memory of 1536 1036 DW20.EXE dwwin.exe PID 1036 wrote to memory of 1536 1036 DW20.EXE dwwin.exe PID 1036 wrote to memory of 1536 1036 DW20.EXE dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.DOC.Kryptik.Q.17206.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11722⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11723⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1536