Analysis

  • max time kernel
    75s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    20/10/2020, 23:08

General

  • Target

    doc_pack-640927368.xls

  • Size

    62KB

  • MD5

    a9a4dc13d6aa1048cbe6fee8b677cc8a

  • SHA1

    b2d43ee61a085649be172f235bafd0bf69a9a449

  • SHA256

    37cad4af392fa67e5bb0d8df00139c1f4466c35c61310ed8e29ea89b90cdf6b5

  • SHA512

    9ed8ae58eb7b737190ea4772dbe388b29fc1ae75751005b404dd6f81603219a3e87cdcfac0513baf46c6384eb9e28d3d9b8f5fea1da2c8e05dfd34768dc07ecb

Score
6/10

Malware Config

Signatures

  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\doc_pack-640927368.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3488
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4728
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 4728
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2212

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2212-6-0x000002C5FDD50000-0x000002C5FDD51000-memory.dmp

    Filesize

    4KB

  • memory/2212-7-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-8-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-13-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-12-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-11-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-10-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-9-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-14-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-15-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-16-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-17-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-18-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-20-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-19-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-22-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-21-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-23-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-24-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-25-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-26-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-27-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-28-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-29-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-30-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-31-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-32-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-33-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-34-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-35-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-36-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-37-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-38-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-39-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-40-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-41-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-42-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-43-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-44-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-45-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-46-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-47-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-49-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-48-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-50-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-51-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-65-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-64-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-63-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-62-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-61-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-60-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-59-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-58-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-57-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-56-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-55-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-54-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-53-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-52-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-66-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-67-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-68-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-69-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-70-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-71-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-72-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-73-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-74-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-75-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-76-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-77-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-82-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-81-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-80-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-79-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-78-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-83-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-84-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-85-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-86-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-87-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-88-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-90-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-89-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-92-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-91-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-94-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-93-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-95-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-96-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-98-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-97-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-100-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-99-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-101-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-102-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-103-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-104-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-105-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-106-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-107-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-109-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-108-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-110-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-111-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-112-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-113-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-114-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-115-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-116-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-117-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-118-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-119-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-120-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-121-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-122-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-123-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-124-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-125-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-126-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-133-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-132-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-131-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-130-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-129-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-128-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-127-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-135-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-136-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-138-0x000002C5807D0000-0x000002C5807D1000-memory.dmp

    Filesize

    4KB

  • memory/2212-139-0x000002C580B60000-0x000002C580B61000-memory.dmp

    Filesize

    4KB

  • memory/2212-140-0x000002C580B60000-0x000002C580B61000-memory.dmp

    Filesize

    4KB

  • memory/2212-141-0x000002C580B60000-0x000002C580B61000-memory.dmp

    Filesize

    4KB

  • memory/2212-142-0x000002C580710000-0x000002C580711000-memory.dmp

    Filesize

    4KB

  • memory/3488-0-0x00007FFCD2DC0000-0x00007FFCD3486000-memory.dmp

    Filesize

    6.8MB