Analysis Overview
SHA256
922a59dcf3df8e8dcfe014bc27103323da69a09990ef0ed59a805eeeda115e33
Threat Level: Known bad
The file doc_pack-668001904.xls was found to be: Known bad.
Malicious Activity Summary
Office macro that triggers on suspicious action
Suspicious Office macro
Process spawned suspicious child process
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks processor information in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2020-10-20 23:12
Signatures
Office macro that triggers on suspicious action
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious Office macro
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Reported
0001-01-01 00:00
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2020-10-20 23:12
Reported
2020-10-20 23:23
Platform
win10v200722
Max time kernel
81s
Max time network
148s
Command Line
Signatures
Process spawned suspicious child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Windows\system32\dwwin.exe | N/A |
| N/A | N/A | C:\Windows\system32\dwwin.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3876 wrote to memory of 4028 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE |
| PID 3876 wrote to memory of 4028 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE |
| PID 4028 wrote to memory of 1504 | N/A | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE | C:\Windows\system32\dwwin.exe |
| PID 4028 wrote to memory of 1504 | N/A | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE | C:\Windows\system32\dwwin.exe |
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\doc_pack-668001904.xls"
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4672
C:\Windows\system32\dwwin.exe
C:\Windows\system32\dwwin.exe -x -s 4672
Network
Files
memory/3876-0-0x00007FFC63190000-0x00007FFC63856000-memory.dmp
memory/3876-2-0x0000015EC8B17000-0x0000015EC8B43000-memory.dmp
memory/3876-1-0x0000015EC8B17000-0x0000015EC8B43000-memory.dmp
memory/3876-3-0x0000015EC8B17000-0x0000015EC8B43000-memory.dmp
memory/4028-4-0x0000000000000000-mapping.dmp
memory/1504-5-0x0000000000000000-mapping.dmp
memory/1504-6-0x000001FD95BE0000-0x000001FD95BE1000-memory.dmp
memory/1504-7-0x000001FD95BE0000-0x000001FD95BE1000-memory.dmp
memory/1504-9-0x000001FD96220000-0x000001FD96221000-memory.dmp
memory/1504-12-0x000001FD96220000-0x000001FD96221000-memory.dmp
memory/1504-13-0x000001FD96620000-0x000001FD96621000-memory.dmp
memory/1504-15-0x000001FD96560000-0x000001FD96561000-memory.dmp
memory/1504-16-0x000001FD96560000-0x000001FD96561000-memory.dmp
memory/1504-17-0x000001FD96560000-0x000001FD96561000-memory.dmp
memory/1504-18-0x000001FD96160000-0x000001FD96161000-memory.dmp