Analysis
-
max time kernel
149s -
max time network
6s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-07-2020 15:11
Static task
static1
Behavioral task
behavioral1
Sample
c2cdef7c7ca6c449b0dce22296f2c66b3a791f626770ce2527954210c803cb77.xls
Resource
win7v200430
Behavioral task
behavioral2
Sample
c2cdef7c7ca6c449b0dce22296f2c66b3a791f626770ce2527954210c803cb77.xls
Resource
win10
General
-
Target
c2cdef7c7ca6c449b0dce22296f2c66b3a791f626770ce2527954210c803cb77.xls
-
Size
351KB
-
MD5
fd43a994cba26ec427b9e1b19be8b7e5
-
SHA1
1b20ae3026c47321e4a2eaa7c0f9ee087fd24d4b
-
SHA256
c2cdef7c7ca6c449b0dce22296f2c66b3a791f626770ce2527954210c803cb77
-
SHA512
243efcb7c9c92ce332c743107cef3176047f1052b974594a3917dffcf3c404347c6a8a8796020fc43f35d9efa844f58cf8b99cf9af146da6e932b29e50e2c013
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1360 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1360 EXCEL.EXE 1360 EXCEL.EXE 1360 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 1360 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1040 1360 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 1360 wrote to memory of 1040 1360 EXCEL.EXE DW20.EXE PID 1360 wrote to memory of 1040 1360 EXCEL.EXE DW20.EXE PID 1360 wrote to memory of 1040 1360 EXCEL.EXE DW20.EXE PID 1360 wrote to memory of 1040 1360 EXCEL.EXE DW20.EXE PID 1360 wrote to memory of 1040 1360 EXCEL.EXE DW20.EXE PID 1040 wrote to memory of 1000 1040 DW20.EXE dwwin.exe PID 1040 wrote to memory of 1000 1040 DW20.EXE dwwin.exe PID 1040 wrote to memory of 1000 1040 DW20.EXE dwwin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 1000 dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\c2cdef7c7ca6c449b0dce22296f2c66b3a791f626770ce2527954210c803cb77.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11562⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11563⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1000