Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    20/10/2020, 22:25

General

  • Target

    doc_pack-352590073.xls

  • Size

    62KB

  • MD5

    ef2dfe0447620f796e324aed70582e4e

  • SHA1

    469ed63cc853515d1c27a1e1d12cedcd5e3df45b

  • SHA256

    bc15dca3e68b7c8c3fc82ec997e688fdd7de323b20c9489d369e67401c1b4fd1

  • SHA512

    36cf861b69c7f69d46ea08df262c101b65602f753cd5294ebeb89734fb035eda38eae7048cbb692d10402cff971a603fd7b51d733c4c4e6fd598bfed9888a131

Score
6/10

Malware Config

Signatures

  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\doc_pack-352590073.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4424
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 4424
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1664

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/772-0-0x00007FFED14D0000-0x00007FFED1B96000-memory.dmp

    Filesize

    6.8MB

  • memory/1664-5-0x000001F1FC260000-0x000001F1FC261000-memory.dmp

    Filesize

    4KB

  • memory/1664-6-0x000001F1FC260000-0x000001F1FC261000-memory.dmp

    Filesize

    4KB

  • memory/1664-8-0x000001F1FCA80000-0x000001F1FCA81000-memory.dmp

    Filesize

    4KB

  • memory/1664-9-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-10-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-11-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-12-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-13-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-14-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-15-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-16-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-17-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-18-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-19-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-20-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-21-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-22-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-23-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-24-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-25-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-26-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-27-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-28-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-29-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-30-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-31-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-32-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-33-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-34-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-35-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-36-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-37-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-38-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-39-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-40-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-41-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-42-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-43-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-44-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-45-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-47-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-46-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-48-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-49-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-50-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-51-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-52-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-53-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-54-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-55-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-56-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-57-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-58-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-59-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-60-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-61-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-62-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-63-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-64-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-65-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-66-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-67-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-68-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-69-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-70-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-71-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-72-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-73-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-74-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-75-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-76-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-77-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-78-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-79-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-80-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-81-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-82-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-83-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-84-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-85-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-86-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-87-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-88-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-89-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-90-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-91-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-92-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-93-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-94-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-95-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-96-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-97-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-98-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-99-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-100-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-101-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-102-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-103-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-104-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-105-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-106-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-107-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-108-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-109-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-110-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-111-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-112-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-113-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-114-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-115-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-116-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-117-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-118-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-119-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-120-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-121-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-122-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-123-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-124-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-125-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-126-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-127-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-128-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-129-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-130-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-131-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-132-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-133-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-134-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-135-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-136-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-137-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-138-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-139-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-140-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-141-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-142-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-143-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-144-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-145-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-146-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-147-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-148-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-149-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-150-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB

  • memory/1664-151-0x000001F1803B0000-0x000001F1803B1000-memory.dmp

    Filesize

    4KB