ea597641de8a19fd57c2873cc9f87e1f39c68b6ce56b471804e458a92ad19297

Analysis

max time kernel
103s
max time network
21s
platform
windows7_x64
resource
win7
submitted
15/07/2020, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

in_9.xls
Size

90KB
MD5

b569a368d36af422cf9c32656b3210ae
SHA1

0db43b4b6e1da2923cdafc4e21fd3054942f240c
SHA256

ea597641de8a19fd57c2873cc9f87e1f39c68b6ce56b471804e458a92ad19297
SHA512

ae269e82b06c9fe3b3ac275611d961ba1bedda4416e49f778896282b65120e760c9462d3327279fbb448f2f2e32cc27951152aed109c2a7d1fe83197cc8f867b

Score

6^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1124	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1124	EXCEL.EXE
1124	EXCEL.EXE
1124	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1124	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1416	1124	DW20.EXE	23

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1416	1124	EXCEL.EXE	24
PID 1124 wrote to memory of 1416	1124	EXCEL.EXE	24
PID 1124 wrote to memory of 1416	1124	EXCEL.EXE	24
PID 1124 wrote to memory of 1416	1124	EXCEL.EXE	24
PID 1124 wrote to memory of 1416	1124	EXCEL.EXE	24
PID 1416 wrote to memory of 1428	1416	DW20.EXE	25
PID 1416 wrote to memory of 1428	1416	DW20.EXE	25
PID 1416 wrote to memory of 1428	1416	DW20.EXE	25

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1428	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\in_9.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1124
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1164
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1164
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-2-0x0000000001E30000-0x0000000001E41000-memory.dmp

Filesize
68KB

Download
memory/1428-4-0x0000000002360000-0x0000000002371000-memory.dmp

Filesize
68KB

Download