e0f9d5d4e662c52d511d844f59fc9e13f998346948183969c13968651a273482

Analysis

max time kernel
147s
max time network
41s
platform
windows7_x64
resource
win7v200430
submitted
16/07/2020, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

form_05241580.xls
Size

274KB
MD5

7a6d0e715445d634d46c1276fc436ccf
SHA1

c0cdce5e9b8566a53d32c8b3c2fc759263627972
SHA256

e0f9d5d4e662c52d511d844f59fc9e13f998346948183969c13968651a273482
SHA512

cfe4bb24a98574d446d9759a0b1cca634d641ef6a34140bb1fc171e66555ee22796116696af9080ed74fc34c0d0aecaca1e41336455e059b06ed059a0d803312

Score

6^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1472	1292	EXCEL.EXE	24
PID 1292 wrote to memory of 1472	1292	EXCEL.EXE	24
PID 1292 wrote to memory of 1472	1292	EXCEL.EXE	24
PID 1292 wrote to memory of 1472	1292	EXCEL.EXE	24
PID 1292 wrote to memory of 1472	1292	EXCEL.EXE	24
PID 1472 wrote to memory of 1560	1472	DW20.EXE	25
PID 1472 wrote to memory of 1560	1472	DW20.EXE	25
PID 1472 wrote to memory of 1560	1472	DW20.EXE	25

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1560	dwwin.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1292	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1292	EXCEL.EXE
1292	EXCEL.EXE
1292	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1292	EXCEL.EXE

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1472	1292	DW20.EXE	23

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\form_05241580.xls
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
PID:1292
- C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1168
  2⤵
  - Suspicious use of WriteProcessMemory
  - Process spawned suspicious child process
  PID:1472
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 1168
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-2-0x0000000001D10000-0x0000000001D21000-memory.dmp

Filesize
68KB

Download
memory/1560-4-0x0000000002300000-0x0000000002311000-memory.dmp

Filesize
68KB

Download