Analysis
-
max time kernel
73s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 02:39
Behavioral task
behavioral1
Sample
eecc250e3959ffaa3572218c0490ceb5c5597f11d4f6a225e13574ebdb3db71e.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
eecc250e3959ffaa3572218c0490ceb5c5597f11d4f6a225e13574ebdb3db71e.xls
Resource
win10v2004-20220901-en
General
-
Target
eecc250e3959ffaa3572218c0490ceb5c5597f11d4f6a225e13574ebdb3db71e.xls
-
Size
4.8MB
-
MD5
90cede352673de54b372ca7bcd138ffc
-
SHA1
3ad05e2b6b5044d556aada87e3bfe93d2ea21f2c
-
SHA256
eecc250e3959ffaa3572218c0490ceb5c5597f11d4f6a225e13574ebdb3db71e
-
SHA512
30f585d3d138abfb2ee7c19079f25b19e3245a016e6d04038603f633823bccc338711c8d19bd12f8e897252acd5b8d4222f301ba711e865b79d0dc639f281ded
-
SSDEEP
98304:Ov4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXs:OvpvFa+g8RWLdPk/84tCEr0RtNiC5eS9
Malware Config
Signatures
-
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4132 4728 DW20.EXE EXCEL.EXE -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dwwin.exeEXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dwwin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dwwin.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dwwin.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
EXCEL.EXEdwwin.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dwwin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwwin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4728 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
EXCEL.EXEpid process 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE 4728 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 4728 wrote to memory of 4132 4728 EXCEL.EXE DW20.EXE PID 4728 wrote to memory of 4132 4728 EXCEL.EXE DW20.EXE PID 4132 wrote to memory of 2744 4132 DW20.EXE dwwin.exe PID 4132 wrote to memory of 2744 4132 DW20.EXE dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\eecc250e3959ffaa3572218c0490ceb5c5597f11d4f6a225e13574ebdb3db71e.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 21122⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 21123⤵
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2744-147-0x0000000000000000-mapping.dmp
-
memory/4132-141-0x0000000000000000-mapping.dmp
-
memory/4132-152-0x00007FFE73230000-0x00007FFE73240000-memory.dmpFilesize
64KB
-
memory/4132-151-0x00007FFE73230000-0x00007FFE73240000-memory.dmpFilesize
64KB
-
memory/4132-150-0x00007FFE73230000-0x00007FFE73240000-memory.dmpFilesize
64KB
-
memory/4132-149-0x00007FFE73230000-0x00007FFE73240000-memory.dmpFilesize
64KB
-
memory/4728-136-0x00007FFE73230000-0x00007FFE73240000-memory.dmpFilesize
64KB
-
memory/4728-139-0x0000021818030000-0x0000021818034000-memory.dmpFilesize
16KB
-
memory/4728-140-0x000002181B49F000-0x000002181B4A1000-memory.dmpFilesize
8KB
-
memory/4728-138-0x00007FFE708D0000-0x00007FFE708E0000-memory.dmpFilesize
64KB
-
memory/4728-137-0x00007FFE708D0000-0x00007FFE708E0000-memory.dmpFilesize
64KB
-
memory/4728-148-0x000002181B769000-0x000002181B76B000-memory.dmpFilesize
8KB
-
memory/4728-132-0x00007FFE73230000-0x00007FFE73240000-memory.dmpFilesize
64KB
-
memory/4728-135-0x00007FFE73230000-0x00007FFE73240000-memory.dmpFilesize
64KB
-
memory/4728-134-0x00007FFE73230000-0x00007FFE73240000-memory.dmpFilesize
64KB
-
memory/4728-133-0x00007FFE73230000-0x00007FFE73240000-memory.dmpFilesize
64KB