c2cdef7c7ca6c449b0dce22296f2c66b3a791f626770ce2527954210c803cb77

Analysis

max time kernel
149s
max time network
6s
platform
windows7_x64
resource
win7v200430
submitted
13-07-2020 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2cdef7c7ca6c449b0dce22296f2c66b3a791f626770ce2527954210c803cb77.xls
Size

351KB
MD5

fd43a994cba26ec427b9e1b19be8b7e5
SHA1

1b20ae3026c47321e4a2eaa7c0f9ee087fd24d4b
SHA256

c2cdef7c7ca6c449b0dce22296f2c66b3a791f626770ce2527954210c803cb77
SHA512

243efcb7c9c92ce332c743107cef3176047f1052b974594a3917dffcf3c404347c6a8a8796020fc43f35d9efa844f58cf8b99cf9af146da6e932b29e50e2c013

Score

6^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1360 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1360 EXCEL.EXE
1360 EXCEL.EXE
1360 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

EXCEL.EXE

pid process

1360 EXCEL.EXE

pid	process
1360	EXCEL.EXE

pid	process
1360	EXCEL.EXE
1360	EXCEL.EXE
1360	EXCEL.EXE

pid	process
1360	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

Processes:

DW20.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1040	1360	DW20.EXE	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

EXCEL.EXEDW20.EXE

description	pid	process	target process
PID 1360 wrote to memory of 1040	1360	EXCEL.EXE	DW20.EXE
PID 1360 wrote to memory of 1040	1360	EXCEL.EXE	DW20.EXE
PID 1360 wrote to memory of 1040	1360	EXCEL.EXE	DW20.EXE
PID 1360 wrote to memory of 1040	1360	EXCEL.EXE	DW20.EXE
PID 1360 wrote to memory of 1040	1360	EXCEL.EXE	DW20.EXE
PID 1040 wrote to memory of 1000	1040	DW20.EXE	dwwin.exe
PID 1040 wrote to memory of 1000	1040	DW20.EXE	dwwin.exe
PID 1040 wrote to memory of 1000	1040	DW20.EXE	dwwin.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dwwin.exe

pid process

1000 dwwin.exe

pid	process
1000	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\c2cdef7c7ca6c449b0dce22296f2c66b3a791f626770ce2527954210c803cb77.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1360

C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1156
2⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\system32\dwwin.exe
C:\Windows\system32\dwwin.exe -x -s 1156
3⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\106423.cvr

Download Submit
memory/1000-1-0x0000000000000000-mapping.dmp

Download
memory/1000-2-0x0000000001DE0000-0x0000000001DF1000-memory.dmp

Filesize
68KB

Download
memory/1000-4-0x00000000021B0000-0x00000000021C1000-memory.dmp

Filesize
68KB

Download
memory/1040-0-0x0000000000000000-mapping.dmp

Download