Analysis

  • max time kernel
    85s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    20/10/2020, 22:25

General

  • Target

    doc_pack-329653596.xls

  • Size

    62KB

  • MD5

    f9f36e3052e281bc1c8e58a8e944d439

  • SHA1

    e1a370ac15c32b833eb29664767d9963cc84e566

  • SHA256

    c478ba5a626fc1bf7d3a08865c0ee00050425c2997a80bdc32d0d21641fdc86f

  • SHA512

    3cc59bdbde2af30f07e66df557334069cc44f66716f13675e33f6c411ccc96cbcb70b68893a2198f4cca1e9ded3845c8553bb912fefb8e27fe95c9097f8b4ea7

Score
6/10

Malware Config

Signatures

  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\doc_pack-329653596.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4028
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4688
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:3672
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 4688
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3108

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3108-5-0x000001CA59AA0000-0x000001CA59AA1000-memory.dmp

    Filesize

    4KB

  • memory/3108-6-0x000001CA59AA0000-0x000001CA59AA1000-memory.dmp

    Filesize

    4KB

  • memory/3108-8-0x000001CA5A1E0000-0x000001CA5A1E1000-memory.dmp

    Filesize

    4KB

  • memory/3108-12-0x000001CA5A480000-0x000001CA5A481000-memory.dmp

    Filesize

    4KB

  • memory/3108-11-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-13-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-14-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-15-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-16-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-17-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-18-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-19-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-20-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-21-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-22-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-23-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-24-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-25-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-26-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-27-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-28-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-29-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-30-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-31-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-32-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-33-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-34-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-35-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-36-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-37-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-38-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-39-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-40-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-41-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-43-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-42-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-44-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-45-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-46-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-47-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-48-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-49-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-50-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-51-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-52-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-53-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-54-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-55-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-56-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-57-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-58-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-59-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-60-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-61-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-62-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-63-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-64-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-65-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-66-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-67-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-68-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-69-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-70-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-71-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-72-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-73-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-74-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-75-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-76-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-77-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-78-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-79-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-80-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-81-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-82-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-83-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-84-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-85-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-86-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-87-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-88-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-89-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-90-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-91-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-92-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-93-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-94-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-95-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-96-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-97-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-98-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-99-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-100-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-101-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-102-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-103-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-104-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-105-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-106-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-107-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-108-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-109-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-110-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-111-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-112-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-113-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-114-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-115-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-116-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-117-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-118-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-119-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-120-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-121-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-122-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-123-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-124-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-125-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-126-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-127-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-128-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-129-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-130-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-131-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-132-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-133-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-134-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-135-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-136-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-137-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-138-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-139-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-140-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-141-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-142-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-143-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-144-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-145-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-146-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-147-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-148-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-149-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-150-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-151-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-152-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-153-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-154-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-155-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-156-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-157-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-158-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-159-0x000001CA581A0000-0x000001CA581A1000-memory.dmp

    Filesize

    4KB

  • memory/3108-161-0x000001CA5A480000-0x000001CA5A481000-memory.dmp

    Filesize

    4KB

  • memory/3108-162-0x000001CA5A480000-0x000001CA5A481000-memory.dmp

    Filesize

    4KB

  • memory/3108-163-0x000001CA5A120000-0x000001CA5A121000-memory.dmp

    Filesize

    4KB

  • memory/4028-0-0x00007FFCD30F0000-0x00007FFCD37B6000-memory.dmp

    Filesize

    6.8MB