Analysis

  • max time kernel
    88s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    19/10/2020, 23:32

General

  • Target

    document-138161646.xls

  • Size

    426KB

  • MD5

    24f7d2c93d14bd25c8295a85997d9abe

  • SHA1

    46a1dc4d5855c2e29889705638c80285c303cf62

  • SHA256

    1422ce2cd2fe424a4441f4205b38dd68054cde2995a4af3a78a5f3d452b1f340

  • SHA512

    0a8924fe428035503bef0cc23e6be6e7c9b13b8b7efd521f3d1051a7070a4c972d2e9905327dec6e56070c8896ae71fc20f77a9d4de5d3bfed2dc22a69921dac

Score
6/10

Malware Config

Signatures

  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-138161646.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3952
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4752
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 4752
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1336

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1336-4-0x000002B3EF8E0000-0x000002B3EF8E1000-memory.dmp

          Filesize

          4KB

        • memory/1336-5-0x000002B3EF8E0000-0x000002B3EF8E1000-memory.dmp

          Filesize

          4KB

        • memory/1336-7-0x000002B3F0020000-0x000002B3F0021000-memory.dmp

          Filesize

          4KB

        • memory/1336-10-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-11-0x000002B3F02C0000-0x000002B3F02C1000-memory.dmp

          Filesize

          4KB

        • memory/1336-12-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-13-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-14-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-15-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-16-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-17-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-18-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-19-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-20-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-21-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-22-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-23-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-24-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-25-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-26-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-27-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-28-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-29-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-30-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-31-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-32-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-33-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-34-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-35-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-36-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-37-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-38-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-39-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-40-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-41-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-42-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-43-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-44-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-45-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-46-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-47-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-48-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-49-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-50-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-51-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-52-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-53-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-54-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-55-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-56-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-57-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-58-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-59-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-60-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-61-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-62-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-63-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-64-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-65-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-66-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-67-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-68-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-69-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-70-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-71-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-72-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-73-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-74-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-75-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-76-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-77-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-78-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-79-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-80-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-81-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-82-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-83-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-84-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-85-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-86-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-87-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-88-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-89-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-90-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-91-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-92-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-93-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-94-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-95-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-96-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-97-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-98-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-99-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-100-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-101-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-102-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-103-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-104-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-105-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-106-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-107-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-108-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-109-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-110-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-111-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-112-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-113-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-114-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-115-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-116-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-117-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-118-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-119-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-120-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-121-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-122-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-123-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-124-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-125-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-126-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-127-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-128-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-129-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-130-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-131-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-132-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-133-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-134-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-135-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-136-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-137-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-138-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-139-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-140-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-141-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-142-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-143-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-144-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-145-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-146-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-147-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-148-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-149-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-150-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-151-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-152-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-153-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-154-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-155-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-156-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-157-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-158-0x000002B3EDFE0000-0x000002B3EDFE1000-memory.dmp

          Filesize

          4KB

        • memory/1336-160-0x000002B3F02C0000-0x000002B3F02C1000-memory.dmp

          Filesize

          4KB

        • memory/1336-161-0x000002B3F02C0000-0x000002B3F02C1000-memory.dmp

          Filesize

          4KB

        • memory/1336-162-0x000002B3EFF60000-0x000002B3EFF61000-memory.dmp

          Filesize

          4KB

        • memory/3952-0-0x00007FFB46530000-0x00007FFB46BF6000-memory.dmp

          Filesize

          6.8MB