0a3a6163a5e8e372fa96efbef3feb793463f4e39bd2c4d6ea03afce045f90636

Analysis

max time kernel
23s
max time network
141s
platform
windows10_x64
resource
win10v20201028
submitted
14-01-2021 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Document_1495694596-Copy.xls
Size

43KB
MD5

e758a4b1340fd50274edefd581cd8c52
SHA1

945f507232ddbe940e09ac69a4e8592aa55590ed
SHA256

4e2f37d4228e78faa1f34121ee934f58e1a9862ad6f183edf4c24e08cda20363
SHA512

3393143e4215b8cff172d7a4a79d6116667ebc0999ab3eea1656616375856a798e8b5caf4728deb4cae1ecef4e83405c145b8373dca6f101654470f525d4f269

Score

6^/10

Malware Config

Signatures

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

Processes:

DW20.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	196	640	DW20.EXE	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

640 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

EXCEL.EXEdwwin.exe

pid process

640 EXCEL.EXE
640 EXCEL.EXE
936 dwwin.exe
936 dwwin.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

EXCEL.EXE

pid process

640 EXCEL.EXE
640 EXCEL.EXE
640 EXCEL.EXE
640 EXCEL.EXE
640 EXCEL.EXE
640 EXCEL.EXE
640 EXCEL.EXE
640 EXCEL.EXE

pid	process
640	EXCEL.EXE

pid	process
640	EXCEL.EXE
640	EXCEL.EXE
936	dwwin.exe
936	dwwin.exe

pid	process
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

EXCEL.EXEDW20.EXE

description	pid	process	target process
PID 640 wrote to memory of 196	640	EXCEL.EXE	DW20.EXE
PID 640 wrote to memory of 196	640	EXCEL.EXE	DW20.EXE
PID 196 wrote to memory of 936	196	DW20.EXE	dwwin.exe
PID 196 wrote to memory of 936	196	DW20.EXE	dwwin.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Document_1495694596-Copy.xls"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4352
2⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:196

C:\Windows\system32\dwwin.exe
C:\Windows\system32\dwwin.exe -x -s 4352
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:936

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/196-3-0x0000000000000000-mapping.dmp

Download
memory/640-2-0x00007FFC34060000-0x00007FFC34697000-memory.dmp

Filesize
6.2MB

Download
memory/936-4-0x0000000000000000-mapping.dmp

Download
memory/936-5-0x000002B9DA4A0000-0x000002B9DA4A1000-memory.dmp

Filesize
4KB

Download
memory/936-6-0x000002B9DA4A0000-0x000002B9DA4A1000-memory.dmp

Filesize
4KB

Download
memory/936-8-0x000002B9DAB70000-0x000002B9DAB71000-memory.dmp

Filesize
4KB

Download
memory/936-11-0x000002B9DAF70000-0x000002B9DAF71000-memory.dmp

Filesize
4KB

Download
memory/936-13-0x000002B9DADE0000-0x000002B9DADE1000-memory.dmp

Filesize
4KB

Download
memory/936-14-0x000002B9DADE0000-0x000002B9DADE1000-memory.dmp

Filesize
4KB

Download
memory/936-15-0x000002B9DADE0000-0x000002B9DADE1000-memory.dmp

Filesize
4KB

Download