Overview

overview

10

Static

static

8

Document_1...py.xls

windows7_x64

10

Document_1...py.xls

windows10_x64

6

Analysis

  • max time kernel
    21s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-01-2021 16:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Document_1356928040-Copy.xls

  • Size

    43KB

  • MD5

    eab3ae82721b551be63502b18ecf3825

  • SHA1

    1659464cc4364cbad38e1aa36e12931e68e77d6b

  • SHA256

    e14f6ab34e3506d6985816af85935932fb6faf8bad9d2c7dd96d6011d7c21a33

  • SHA512

    d356fd7dab9cf1addad1389369ef1f0cd6d95dfcbc6d67a4df9647045bcca6eebe0314031fdcd0f77c045c45ed2fdd26f7346d6bed5ff40be273e17e1004e15f

Score
6/10

Malware Config

Signatures

  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Document_1356928040-Copy.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:428
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4352
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 4352
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/428-2-0x00007FFE6CB30000-0x00007FFE6D167000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1968-4-0x0000000000000000-mapping.dmp
    Download
  • memory/1968-5-0x0000023B9CF10000-0x0000023B9CF11000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1968-6-0x0000023B9CF10000-0x0000023B9CF11000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1968-8-0x0000023B9D750000-0x0000023B9D751000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1968-11-0x0000023B9D9D0000-0x0000023B9D9D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1968-12-0x0000023B9D9D0000-0x0000023B9D9D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1968-13-0x0000023B9D9D0000-0x0000023B9D9D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2320-3-0x0000000000000000-mapping.dmp
    Download