da21cec62d9b7cf3e162b4e6a6e8d29262280e57f423860a8052c4512304186f

Analysis

max time kernel
114s
max time network
119s
platform
windows7_x64
resource
win7
submitted
13/07/2020, 19:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.DOC.Kryptik.Q.13895.xls
Size

293KB
MD5

a402ee26ec56afffa6f638b9cfa2e646
SHA1

f4db2a82f5dad24e4a6260e463b4ce7fbb37c802
SHA256

da21cec62d9b7cf3e162b4e6a6e8d29262280e57f423860a8052c4512304186f
SHA512

a6221a2e19e1d9f95942e07410c1f3aca181d28dfb51e60f7c19f9eff3977ada2bb3e3ec892c4c2271854a3d750ffb58c8eb6f6a5f30e5af4e40c03e80a11759

Score

6^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
316	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
316	EXCEL.EXE
316	EXCEL.EXE
316	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
316	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	868	316	DW20.EXE	23

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 868	316	EXCEL.EXE	24
PID 316 wrote to memory of 868	316	EXCEL.EXE	24
PID 316 wrote to memory of 868	316	EXCEL.EXE	24
PID 316 wrote to memory of 868	316	EXCEL.EXE	24
PID 316 wrote to memory of 868	316	EXCEL.EXE	24
PID 868 wrote to memory of 1632	868	DW20.EXE	25
PID 868 wrote to memory of 1632	868	DW20.EXE	25
PID 868 wrote to memory of 1632	868	DW20.EXE	25

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1632	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.DOC.Kryptik.Q.13895.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:316
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1180
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1180
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-2-0x0000000001EE0000-0x0000000001EF1000-memory.dmp

Filesize
68KB

Download
memory/1632-4-0x0000000002380000-0x0000000002391000-memory.dmp

Filesize
68KB

Download