Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 18:23
Behavioral task
behavioral1
Sample
25f38e495c62f03e99448b42c223b6cb30052cdbd9aa12ad730345a93fa1bc3a.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
25f38e495c62f03e99448b42c223b6cb30052cdbd9aa12ad730345a93fa1bc3a.xls
Resource
win10v2004-20221111-en
General
-
Target
25f38e495c62f03e99448b42c223b6cb30052cdbd9aa12ad730345a93fa1bc3a.xls
-
Size
32KB
-
MD5
bf06f4164814d518322dc153df11a8b9
-
SHA1
e545c6b9267df6c8b95bf1d762bbbad7575b5935
-
SHA256
25f38e495c62f03e99448b42c223b6cb30052cdbd9aa12ad730345a93fa1bc3a
-
SHA512
5a6f67ac81b9816400fd7996b89af8e37fca15d94161cbb812b7505d9912fa54a3a551eb4508e02f10098a9b809faf08094604444bf1a22e4d870599b6ca9cb5
-
SSDEEP
768:pzQzc0GLbtV8cLbsQvPe8k1Szm+R2S3cyzghlBAUrR9jzt6C7+4Z:pzQzc0GLbtV8cLbsQvPe8k1SzmGcyzgF
Malware Config
Signatures
-
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4688 5048 DW20.EXE EXCEL.EXE -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dwwin.exeEXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dwwin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dwwin.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dwwin.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
EXCEL.EXEdwwin.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dwwin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwwin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 5048 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
EXCEL.EXEpid process 5048 EXCEL.EXE 5048 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 49 IoCs
Processes:
EXCEL.EXEpid process 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE 5048 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 5048 wrote to memory of 4688 5048 EXCEL.EXE DW20.EXE PID 5048 wrote to memory of 4688 5048 EXCEL.EXE DW20.EXE PID 4688 wrote to memory of 3996 4688 DW20.EXE dwwin.exe PID 4688 wrote to memory of 3996 4688 DW20.EXE dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\25f38e495c62f03e99448b42c223b6cb30052cdbd9aa12ad730345a93fa1bc3a.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 34922⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 34923⤵
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3996-145-0x0000000000000000-mapping.dmp
-
memory/4688-139-0x0000000000000000-mapping.dmp
-
memory/5048-132-0x00007FF9B2750000-0x00007FF9B2760000-memory.dmpFilesize
64KB
-
memory/5048-133-0x00007FF9B2750000-0x00007FF9B2760000-memory.dmpFilesize
64KB
-
memory/5048-134-0x00007FF9B2750000-0x00007FF9B2760000-memory.dmpFilesize
64KB
-
memory/5048-135-0x00007FF9B2750000-0x00007FF9B2760000-memory.dmpFilesize
64KB
-
memory/5048-136-0x00007FF9B2750000-0x00007FF9B2760000-memory.dmpFilesize
64KB
-
memory/5048-137-0x00007FF9AFE90000-0x00007FF9AFEA0000-memory.dmpFilesize
64KB
-
memory/5048-138-0x00007FF9AFE90000-0x00007FF9AFEA0000-memory.dmpFilesize
64KB