Analysis
- max time kernel
124s - max time network
147s - platform
windows10_x64 - resource
win10v200430 - submitted
17/07/2020, 16:13
General
- Target notice_4275872.xls
- Size 368KB
- Sample200717-tgrahfvntn
- SHA256 b61ae5b6a687b1a94ab933eddbff0e14c0521a4207dff363b150975c7fa54e4d
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 4 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\notice_4275872.xls"1⤵
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 45282⤵
- Suspicious use of WriteProcessMemory
- Process spawned suspicious child process
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 45283⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3688-2-0x00000264A3C80000-0x00000264A3C81000-memory.dmp
memory/3688-3-0x00000264A3C80000-0x00000264A3C81000-memory.dmp
memory/3688-5-0x00000264A4420000-0x00000264A4421000-memory.dmp
memory/3688-6-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-7-0x00000264A47B0000-0x00000264A47B1000-memory.dmp
memory/3688-8-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-9-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-10-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-11-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-12-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-13-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-14-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-15-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-16-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-17-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-18-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-19-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-20-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-21-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-22-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-23-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-24-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-25-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-26-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-27-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-29-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-28-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-30-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-31-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-32-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-33-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-34-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-35-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-36-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-37-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-38-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-39-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-40-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-41-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-42-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-43-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-44-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-45-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-46-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-47-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-48-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-49-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-50-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-51-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-52-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-53-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-54-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-55-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-56-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-57-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-58-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-59-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-60-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-61-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-62-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-63-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-64-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-65-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-66-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-67-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-68-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-69-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-70-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-71-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-72-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-73-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-74-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-75-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-76-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-77-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-78-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-79-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-80-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-81-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-82-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-84-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-83-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-85-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-86-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-87-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-88-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-89-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-90-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-91-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-92-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-93-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-94-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-95-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-96-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-97-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-98-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-99-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-100-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-101-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-102-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-103-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-104-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-105-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-106-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-107-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-108-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-109-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-110-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-111-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-112-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-113-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-114-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-115-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-116-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-117-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-118-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-119-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-120-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-121-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-122-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-123-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-124-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-125-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-126-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-127-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-128-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-129-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-130-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-131-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-132-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-133-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-134-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-135-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-136-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-137-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-138-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-139-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-140-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-141-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-142-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-143-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-144-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-145-0x00000264A42D0000-0x00000264A42D1000-memory.dmp
memory/3688-147-0x00000264A47B0000-0x00000264A47B1000-memory.dmp
memory/3688-148-0x00000264A47B0000-0x00000264A47B1000-memory.dmp
memory/3688-149-0x00000264A4340000-0x00000264A4341000-memory.dmp