Analysis

  • max time kernel
    89s
  • max time network
    94s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    20/10/2020, 23:07

General

  • Target

    doc_pack-559363553.xls

  • Size

    62KB

  • MD5

    b1eba9767fd7b694320f563a1fa14ac1

  • SHA1

    693149cb421a0e1bc3253075de63f0409f334b52

  • SHA256

    f8a12eeb6eac98952c9119a3529e8f99f9e256cdc899317d12372ed5caa9982c

  • SHA512

    57312c5c606a8f46b2ea583a8c20656f7261c00edb7276a49e4116b1109d52a5bd8e66a0595ef8d322dcfa686fe48ce63a8fdd2f1eac4a4af14808f53eb2f7c8

Score
6/10

Malware Config

Signatures

  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\doc_pack-559363553.xls"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4284
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 4284
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1624-5-0x00000222FCD60000-0x00000222FCD61000-memory.dmp

    Filesize

    4KB

  • memory/1624-6-0x0000022280830000-0x0000022280831000-memory.dmp

    Filesize

    4KB

  • memory/1624-7-0x0000022280830000-0x0000022280831000-memory.dmp

    Filesize

    4KB

  • memory/1624-9-0x0000022280830000-0x0000022280831000-memory.dmp

    Filesize

    4KB

  • memory/1624-10-0x0000022280C30000-0x0000022280C31000-memory.dmp

    Filesize

    4KB

  • memory/1624-12-0x0000022280B60000-0x0000022280B61000-memory.dmp

    Filesize

    4KB

  • memory/1624-13-0x0000022280B60000-0x0000022280B61000-memory.dmp

    Filesize

    4KB

  • memory/1624-14-0x0000022280B60000-0x0000022280B61000-memory.dmp

    Filesize

    4KB

  • memory/3044-0-0x00007FFBC6960000-0x00007FFBC7026000-memory.dmp

    Filesize

    6.8MB