Analysis
-
max time kernel
103s -
max time network
73s -
platform
windows7_x64 -
resource
win7 -
submitted
14-07-2020 14:55
Static task
static1
Behavioral task
behavioral1
Sample
payment_499285.xls
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
payment_499285.xls
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
payment_499285.xls
-
Size
520KB
-
MD5
0cbeaee243b3d87ebde4437a38da1a3e
-
SHA1
89d03d4e777ba41ad8071ecb5123aa52c9b856eb
-
SHA256
7c398cc722f79e55d41ae267d2ab35cb401e721f710ce7ba249a864195c33af3
-
SHA512
050172e36bdc49689ad3b6ec0d0ec800af23148e932d0107e31f081967939e6f091bcbb70d069f2895debba8ec823a5274a6b72556712eb7971711709f175952
Score
6/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1492 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1492 EXCEL.EXE 1492 EXCEL.EXE 1492 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 1492 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 756 1492 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 1492 wrote to memory of 756 1492 EXCEL.EXE DW20.EXE PID 1492 wrote to memory of 756 1492 EXCEL.EXE DW20.EXE PID 1492 wrote to memory of 756 1492 EXCEL.EXE DW20.EXE PID 1492 wrote to memory of 756 1492 EXCEL.EXE DW20.EXE PID 1492 wrote to memory of 756 1492 EXCEL.EXE DW20.EXE PID 756 wrote to memory of 556 756 DW20.EXE dwwin.exe PID 756 wrote to memory of 556 756 DW20.EXE dwwin.exe PID 756 wrote to memory of 556 756 DW20.EXE dwwin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 556 dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\payment_499285.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11562⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11563⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:556