9ee360f8f38d1210fc36149ccd8ceeeef1652345644e3b7cd979f2f3b38f67fc

Analysis

max time kernel
18s
max time network
98s
platform
windows10_x64
resource
win10
submitted
22/10/2020, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
document-2040507139.xls
Size 426KB
Sample201022-vvdbpm6rte
SHA256 9ee360f8f38d1210fc36149ccd8ceeeef1652345644e3b7cd979f2f3b38f67fc
MD5 ca7313c98d0eb8c6c03c3366b8a4a8a8
SHA1 d20b17cd7651989d84129c67dd29c70f3ce6819c
SHA512 804c043aa7402d57a3a033295919edec66eb4e96ba5d56bd764c4308173878b4d145ff95739e26120a778e83cca768b3fe925f9fbcb4d6530bf2bd24f0a326f7
MD5 SHA1 SHA512

Score

6^/10

Malware Config

Signatures

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1788	3848	DW20.EXE	66

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3848	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3848	EXCEL.EXE
3848	EXCEL.EXE
1848	dwwin.exe
1848	dwwin.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3848	EXCEL.EXE
3848	EXCEL.EXE
3848	EXCEL.EXE
3848	EXCEL.EXE
3848	EXCEL.EXE
3848	EXCEL.EXE
3848	EXCEL.EXE
3848	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 1788	3848	EXCEL.EXE	75
PID 3848 wrote to memory of 1788	3848	EXCEL.EXE	75
PID 1788 wrote to memory of 1848	1788	DW20.EXE	76
PID 1788 wrote to memory of 1848	1788	DW20.EXE	76

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-2040507139.xls"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4312
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 4312
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-5-0x00000237E43B0000-0x00000237E43B1000-memory.dmp

Download

memory/1848-6-0x00000237E43B0000-0x00000237E43B1000-memory.dmp

Download

memory/1848-8-0x00000237E4AF0000-0x00000237E4AF1000-memory.dmp

Download

memory/1848-11-0x00000237E4DE0000-0x00000237E4DE1000-memory.dmp

Download

memory/1848-12-0x00000237E4DE0000-0x00000237E4DE1000-memory.dmp

Download

memory/1848-13-0x00000237E4DE0000-0x00000237E4DE1000-memory.dmp

Download

memory/3848-0-0x00007FFBC6960000-0x00007FFBC7026000-memory.dmp

Download

memory/3848-1-0x000001125C06D000-0x000001125C078000-memory.dmp

Download

memory/3848-2-0x000001125C06D000-0x000001125C078000-memory.dmp

Download