Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7 -
submitted
14-07-2020 14:55
Static task
static1
Behavioral task
behavioral1
Sample
5.xls
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5.xls
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
5.xls
-
Size
529KB
-
MD5
6bdd5e1682037bbb53bbd0469a9d8907
-
SHA1
f99743dfb05662d06cdd4091b44e8f0ae52cf19d
-
SHA256
0370833b979658d5ad2c5a0bd27db32c181d3f7edd6eba3dbc43f6e95bbfc6f7
-
SHA512
e5ea019e5332b9a7524036351d72bd2a9201f35265ba659dc168aca90079a9406560aac81365aa14bd2b272ffa0f661542ac9c9dd2c33558dd4055aabdc57f1d
Score
6/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1496 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1496 EXCEL.EXE 1496 EXCEL.EXE 1496 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 1496 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 740 1496 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 1496 wrote to memory of 740 1496 EXCEL.EXE DW20.EXE PID 1496 wrote to memory of 740 1496 EXCEL.EXE DW20.EXE PID 1496 wrote to memory of 740 1496 EXCEL.EXE DW20.EXE PID 1496 wrote to memory of 740 1496 EXCEL.EXE DW20.EXE PID 1496 wrote to memory of 740 1496 EXCEL.EXE DW20.EXE PID 740 wrote to memory of 324 740 DW20.EXE dwwin.exe PID 740 wrote to memory of 324 740 DW20.EXE dwwin.exe PID 740 wrote to memory of 324 740 DW20.EXE dwwin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 324 dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\5.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11562⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11563⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:324