2c53e8ab0d8eadb0901e3b0aa0646dc8f9d856b23c74dd2163b51e379391538e

Analysis

max time kernel
106s
max time network
57s
platform
windows7_x64
resource
win7v200430
submitted
16/07/2020, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
inv_3.xls
Size 603KB
Sample200716-hff4pr11pj
SHA256 2c53e8ab0d8eadb0901e3b0aa0646dc8f9d856b23c74dd2163b51e379391538e
MD5 b760210e8e1b2e32d9933cf4087c49d9
SHA1 0709a5178491cd2947fd06fcd0e6489fc5a65d8a
SHA512 340c6bc191bf2c3a6a3839c48ed06e628035e0a945b55a3256a6b1f60e0634e71f2544da39cc490db31dd7bba771ccb646e6032f90e60117c60132b739f76bcd
MD5 SHA1 SHA512

Score

6^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
892	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
892	EXCEL.EXE
892	EXCEL.EXE
892	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
892	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1492	892	DW20.EXE	23

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1492	892	EXCEL.EXE	24
PID 892 wrote to memory of 1492	892	EXCEL.EXE	24
PID 892 wrote to memory of 1492	892	EXCEL.EXE	24
PID 892 wrote to memory of 1492	892	EXCEL.EXE	24
PID 892 wrote to memory of 1492	892	EXCEL.EXE	24
PID 1492 wrote to memory of 1568	1492	DW20.EXE	25
PID 1492 wrote to memory of 1568	1492	DW20.EXE	25
PID 1492 wrote to memory of 1568	1492	DW20.EXE	25

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1568	dwwin.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\inv_3.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:892
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1160
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1160
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-2-0x0000000001E20000-0x0000000001E31000-memory.dmp

Download

memory/1568-4-0x0000000002190000-0x00000000021A1000-memory.dmp

Download