Analysis
-
max time kernel
103s -
max time network
68s -
platform
windows7_x64 -
resource
win7 -
submitted
15-07-2020 16:08
Static task
static1
Behavioral task
behavioral1
Sample
fea072ba3f7917af9c87c1a68ea7ee4c0ca39d6df8c5c71843771d198c045e50.xls
Resource
win7
Behavioral task
behavioral2
Sample
fea072ba3f7917af9c87c1a68ea7ee4c0ca39d6df8c5c71843771d198c045e50.xls
Resource
win10v200430
General
-
Target
fea072ba3f7917af9c87c1a68ea7ee4c0ca39d6df8c5c71843771d198c045e50.xls
-
Size
367KB
-
MD5
56a0b81c19d2d17c042e2b2c22744633
-
SHA1
cfb744ac8fdb24cf317d2e33802e878feddfd3e7
-
SHA256
fea072ba3f7917af9c87c1a68ea7ee4c0ca39d6df8c5c71843771d198c045e50
-
SHA512
9d195463a70cac76cdf30d667e1a891ede0a9f25edc1466f3ed955fdd85f65be283eb0d9dfbb872c9d37f00397c9e04ccb1843c478fd56fb09a29525ed37df0f
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 112 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 112 EXCEL.EXE 112 EXCEL.EXE 112 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 112 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1068 112 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 112 wrote to memory of 1068 112 EXCEL.EXE DW20.EXE PID 112 wrote to memory of 1068 112 EXCEL.EXE DW20.EXE PID 112 wrote to memory of 1068 112 EXCEL.EXE DW20.EXE PID 112 wrote to memory of 1068 112 EXCEL.EXE DW20.EXE PID 112 wrote to memory of 1068 112 EXCEL.EXE DW20.EXE PID 1068 wrote to memory of 1652 1068 DW20.EXE dwwin.exe PID 1068 wrote to memory of 1652 1068 DW20.EXE dwwin.exe PID 1068 wrote to memory of 1652 1068 DW20.EXE dwwin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 1652 dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\fea072ba3f7917af9c87c1a68ea7ee4c0ca39d6df8c5c71843771d198c045e50.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11682⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11683⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\72353.cvr
-
memory/1068-0-0x0000000000000000-mapping.dmp
-
memory/1652-1-0x0000000000000000-mapping.dmp
-
memory/1652-2-0x0000000001C30000-0x0000000001C41000-memory.dmpFilesize
68KB
-
memory/1652-4-0x0000000002170000-0x0000000002181000-memory.dmpFilesize
68KB